Description
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHP Group | PHP | 8.4.* – < 8.4.21, 8.5.* – < 8.5.6 | 8.4.21 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php8.4 | 8.4.21-1 | — |
| Debian 13 | php8.4 | 8.4.21-1~deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.1 | — |
| Ubuntu 25.10 | php8.4 | 8.4.11-1ubuntu1.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | php8.4 +23 | 8.4.21-1.el10_2 | RHSA-2026:22649 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | php8.4 +23 | 8.4.21-1.el10_2 | ALSA-2026:22649 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | php8.4 | 8.4.21-1.el10_2 | RLSA-2026:22649 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php8 | 8.5.6-1.1 | openSUSE-SU-2026:10747-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | php85 | 8.5.6-r0 | — |
| Alpine v3.23 | php84 | 8.4.21-r0 | — |
| Alpine v3.23 | php85 | 8.5.6-r0 | — |
| Alpine v3.22 | php84 | 8.4.27-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | php8.4 +27 | 8.4.21-1.amzn2023.0.1 | ALAS2023-2026-1726 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | php8.4 +23 | 8.4.21-1.el10_2 | ELSA-2026-22649 |
Advisories 8
- WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:22649 Important: php8.4 security update AlmaLinux Security Advisories · Nov 6, 2026
- WID-SEC-2026-1433 PHP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:22649 Red Hat Security Advisory: php8.4 security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- ELSA-2026-22649 Important: php8.4 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- ALAS2023-2026-1726 Important: php8.4 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 13, 2026
- RLSA-2026:22649 Important: php8.4 security update Rocky Linux Security Advisories · Jun 5, 2026
- openSUSE-SU-2026:10747-1 php8-8.5.6-1.1 on GA media SUSE / openSUSE Security Updates · May 12, 2026