php php-src Vulnerabilities: CVEs, CISA KEV & Security Advisories

This page aggregates every publicly disclosed vulnerability (CVE) affecting php php-src, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Affected versions and CVEs

Browse every php php-src version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

NEWS80 CVEs
NEWS-cvs2svn80 CVEs
php-5.3.23RC180 CVEs
php-5.4.4RC280 CVEs
php-5.3.2979 CVEs
php-5.3.29RC179 CVEs
php-5.4.30RC179 CVEs
php-5.4.32RC179 CVEs
php-5.5.24RC179 CVEs
php-7.0.074 CVEs
php-5.6.18RC172 CVEs
POST_64BIT_BRANCH_MERGE71 CVEs
POST_AST_MERGE71 CVEs
POST_NATIVE_TLS_MERGE71 CVEs
POST_PHP7_EREG_MYSQL_REMOVALS71 CVEs
POST_PHP7_NSAPI_REMOVAL71 CVEs
POST_PHP7_REMOVALS71 CVEs
POST_PHPNG_MERGE71 CVEs
PRE_64BIT_BRANCH_MERGE71 CVEs
PRE_AST_MERGE71 CVEs
PRE_NATIVE_TLS_MERGE71 CVEs
PRE_PHP7_EREG_MYSQL_REMOVALS71 CVEs
PRE_PHP7_NSAPI_REMOVAL71 CVEs
PRE_PHP7_REMOVALS71 CVEs
PRE_PHPNG_MERGE71 CVEs
php-5.6.19RC169 CVEs
php-7.0.0alpha168 CVEs
php-7.0.0alpha268 CVEs
php-7.0.0beta168 CVEs
php-7.0.0beta268 CVEs
php-7.0.0beta368 CVEs
php-7.0.0RC168 CVEs
php-7.0.0RC268 CVEs
php-7.0.0RC368 CVEs
php-7.0.0RC468 CVEs
php-7.0.0RC568 CVEs
php-7.0.0RC668 CVEs
php-7.0.0RC768 CVEs
php-7.0.0RC868 CVEs
php-7.0.167 CVEs
php-7.0.1RC167 CVEs
php-7.0.3RC165 CVEs
php-7.0.264 CVEs
php-7.0.2RC164 CVEs
php-7.0.4RC164 CVEs
php-7.0.362 CVEs
php-7.0.461 CVEs
php-7.0.5RC160 CVEs
php-7.0.557 CVEs
php-5.6.22RC153 CVEs
php-7.0.7RC151 CVEs
php-5.6.23RC149 CVEs
php-7.0.8RC147 CVEs
php-7.0.845 CVEs
php-7.0.642 CVEs
php-7.0.6RC142 CVEs
php-7.0.742 CVEs
php-5.6.24RC139 CVEs
php-7.0.9RC139 CVEs
php-7.0.937 CVEs
php-5.6.0alpha135 CVEs
php-5.6.135 CVEs
php-5.6.1035 CVEs
php-5.6.10RC135 CVEs
php-5.6.1135 CVEs
php-5.6.11RC135 CVEs
php-5.6.1RC135 CVEs
php-5.6.1234 CVEs
php-5.6.12RC134 CVEs
php-5.6.1334 CVEs
php-5.6.13RC134 CVEs
php-5.6.1434 CVEs
php-5.6.14RC134 CVEs
php-5.6.1534 CVEs
php-5.6.15RC134 CVEs
php-5.6.1634 CVEs
php-5.6.16RC134 CVEs
php-5.6.334 CVEs
php-5.6.3RC134 CVEs
php-5.6.434 CVEs
php-5.6.4RC134 CVEs
php-5.6.534 CVEs
php-5.6.5RC134 CVEs
php-5.6.634 CVEs
php-5.6.6RC134 CVEs
php-5.6.734 CVEs
php-5.6.7RC134 CVEs
php-5.6.834 CVEs
php-5.6.8RC134 CVEs
php-5.6.934 CVEs
php-5.6.9RC134 CVEs
php-5.6.1732 CVEs
php-5.6.17RC132 CVEs
php-5.6.1830 CVEs
php-5.6.1928 CVEs
php-7.0.1026 CVEs
php-7.0.10RC126 CVEs
php-5.6.2024 CVEs
php-5.6.20RC124 CVEs
php-7.0.11RC122 CVEs
php-7.0.12RC121 CVEs
php-7.0.1120 CVEs
php-7.0.1219 CVEs
php-5.6.2117 CVEs
php-5.6.21RC117 CVEs
php-7.0.13RC117 CVEs
php-7.0.1314 CVEs
php-5.6.2213 CVEs
php-7.0.1413 CVEs
php-7.0.14RC113 CVEs
php-5.6.011 CVEs
php-5.6.0alpha211 CVEs
php-5.6.0alpha311 CVEs
php-5.6.0beta111 CVEs
php-5.6.0beta211 CVEs
php-5.6.0beta311 CVEs
php-5.6.0beta411 CVEs
php-5.6.0RC111 CVEs
php-5.6.0RC211 CVEs
php-5.6.0RC311 CVEs
php-5.6.0RC411 CVEs
php-7.1.0alpha211 CVEs
php-5.5.3710 CVEs
php-5.6.2410 CVEs
php-5.6.239 CVEs
php-7.0.159 CVEs
php-7.0.15RC19 CVEs
php-7.0.169 CVEs
php-7.0.16RC19 CVEs
php-7.1.19 CVEs
php-7.1.1RC19 CVEs
php-7.1.39 CVEs
php-7.1.3RC19 CVEs
php-7.1.59 CVEs
php-7.1.5RC19 CVEs
php-5.6.258 CVEs
php-5.6.25RC18 CVEs
php-7.0.178 CVEs
php-7.0.17RC18 CVEs
php-7.0.188 CVEs
php-7.0.18RC18 CVEs
php-7.0.198 CVEs
php-7.0.19RC18 CVEs
php-7.0.208 CVEs
php-7.0.20RC18 CVEs
php-7.1.68 CVEs
php-7.1.6RC18 CVEs
php-5.5.347 CVEs
php-5.6.307 CVEs
php-5.6.30RC17 CVEs
php-5.5.26 CVEs
php-5.5.306 CVEs
php-5.5.326 CVEs
php-5.5.336 CVEs
php-5.5.46 CVEs
php-5.5.76 CVEs
php-5.5.7RC16 CVEs
php-5.5.105 CVEs
php-5.5.10RC15 CVEs
php-5.5.115 CVEs
php-5.5.11RC15 CVEs
php-5.5.125 CVEs
php-5.5.12RC15 CVEs
php-5.5.135 CVEs
php-5.5.13RC15 CVEs
php-5.5.145 CVEs
php-5.5.14RC15 CVEs
php-5.5.185 CVEs
php-5.5.18RC15 CVEs
php-5.5.195 CVEs
php-5.5.19RC15 CVEs
php-5.5.205 CVEs
php-5.5.20RC15 CVEs
php-5.5.215 CVEs
php-5.5.21RC15 CVEs
php-5.5.225 CVEs
php-5.5.22RC15 CVEs
php-5.5.235 CVEs
php-5.5.23RC15 CVEs
php-5.5.245 CVEs
php-5.5.255 CVEs
php-5.5.25RC15 CVEs
php-5.5.265 CVEs
php-5.5.26RC15 CVEs
php-5.5.275 CVEs
php-5.5.27RC15 CVEs
php-5.5.315 CVEs
php-5.5.85 CVEs
php-5.5.8RC15 CVEs
php-5.5.95 CVEs
php-5.5.9RC15 CVEs
php-5.5.294 CVEs
php-5.5.354 CVEs
php-5.5.364 CVEs
php-5.6.274 CVEs
php-5.6.27RC14 CVEs
php-5.5.153 CVEs
php-5.5.15RC13 CVEs
php-5.5.163 CVEs
php-5.5.16RC13 CVEs
php-5.5.173 CVEs
php-5.5.17RC13 CVEs
php-5.4.232 CVEs
php-5.4.23RC12 CVEs
php-5.4.432 CVEs
php-5.6.262 CVEs
php-5.6.26RC12 CVEs
php-5.6.292 CVEs
php-5.6.29RC12 CVEs
imap-2007f_upstream1 CVE
php-5.3.111 CVE
php-5.3.11RC11 CVE
php-5.3.11RC21 CVE
php-5.3.141 CVE
php-5.3.14RC11 CVE
php-5.3.14RC21 CVE
php-5.3.151 CVE
php-5.3.15RC11 CVE
php-5.3.161 CVE
php-5.3.171 CVE
php-5.3.181 CVE
php-5.3.18RC11 CVE
php-5.3.191 CVE
php-5.3.19RC11 CVE
php-5.3.201 CVE
php-5.3.20RC11 CVE
php-5.3.211 CVE
php-5.3.21RC11 CVE
php-5.3.221 CVE
php-5.3.22RC11 CVE
php-5.3.22RC21 CVE
php-5.3.231 CVE
php-5.3.241 CVE
php-5.3.24RC11 CVE
php-5.3.251 CVE
php-5.3.25RC11 CVE
php-5.3.261 CVE
php-5.3.26RC11 CVE
php-5.3.271 CVE
php-5.3.27RC11 CVE
php-5.3.281 CVE
php-5.4.11 CVE
php-5.4.101 CVE
php-5.4.10RC11 CVE
php-5.4.111 CVE
php-5.4.11RC11 CVE
php-5.4.121 CVE
php-5.4.12RC11 CVE
php-5.4.12RC21 CVE
php-5.4.131 CVE
php-5.4.13RC11 CVE
php-5.4.141 CVE
php-5.4.14RC11 CVE
php-5.4.151 CVE
php-5.4.15RC11 CVE
php-5.4.16RC11 CVE
php-5.4.171 CVE
php-5.4.17RC11 CVE
php-5.4.181 CVE
php-5.4.18RC11 CVE
php-5.4.18RC21 CVE
php-5.4.1RC11 CVE
php-5.4.1RC21 CVE
php-5.4.201 CVE
php-5.4.20RC11 CVE
php-5.4.211 CVE
php-5.4.21RC11 CVE
php-5.4.221 CVE
php-5.4.22RC11 CVE
php-5.4.241 CVE
php-5.4.24RC11 CVE
php-5.4.251 CVE
php-5.4.25RC11 CVE
php-5.4.261 CVE
php-5.4.26RC11 CVE
php-5.4.271 CVE
php-5.4.27RC11 CVE
php-5.4.281 CVE
php-5.4.28RC11 CVE
php-5.4.341 CVE
php-5.4.351 CVE
php-5.4.371 CVE
php-5.4.381 CVE
php-5.4.391 CVE
php-5.4.41 CVE
php-5.4.411 CVE
php-5.4.421 CVE
php-5.4.441 CVE
php-5.4.451 CVE
php-5.4.4RC11 CVE
php-5.4.51 CVE
php-5.4.5RC11 CVE
php-5.4.61 CVE
php-5.4.6RC11 CVE
php-5.4.71 CVE
php-5.4.7RC11 CVE
php-5.4.81 CVE
php-5.4.8RC11 CVE
php-5.4.91 CVE
php-5.4.9RC11 CVE
php-5.5.281 CVE
php-5.6.281 CVE
php-5.6.28RC11 CVE
php-7.0.211 CVE
php-7.0.21RC11 CVE
php-7.0.221 CVE
php-7.0.22RC11 CVE
php-7.1.71 CVE
php-7.1.7RC11 CVE
v3.10.01 CVE
v3.10.0a11 CVE
v3.10.0a21 CVE
v3.10.0a31 CVE
v3.10.0a41 CVE
v3.10.0a51 CVE
v3.10.0a61 CVE
v3.10.0a71 CVE
v3.10.0b11 CVE
v3.10.0b21 CVE
v3.10.0b31 CVE
v3.10.0b41 CVE
v3.10.0rc11 CVE
v3.10.0rc21 CVE
v3.10.11 CVE
v3.10.21 CVE
v3.10.31 CVE
v3.10.41 CVE
v3.10.51 CVE
v3.10.61 CVE
v3.10.71 CVE
v3.10.81 CVE
v3.4.61 CVE
v3.4.6rc11 CVE
v3.5.31 CVE
v3.5.3rc11 CVE
v3.6.01 CVE
v3.7.0a11 CVE
v3.7.0a21 CVE
v3.7.0a31 CVE
v3.7.0a41 CVE
v3.8.0a11 CVE
v3.8.0a21 CVE
v3.8.0a31 CVE
v3.8.0a41 CVE
v3.8.0b11 CVE
v3.9.0a11 CVE
v3.9.0a21 CVE
v3.9.0a31 CVE
v3.9.0a41 CVE
v3.9.0a51 CVE
v3.9.0a61 CVE

Fixed in

23e05bdcf23319f4922513a91bb0d5e3925d52496 CVEs
260468acea4651c4721ec6fd3fa5f233deea2bca6 CVEs
2e280a77845f3ca94ef19a1872106c52ad1cf4e36 CVEs
38123aca18c3c1bd1f109ec77af2f175d7afcf356 CVEs
643a161a24e662fd2afa9bf3591b105f4881e93e6 CVEs
9ebd7f36b1bcbb2b425ab8e903846f3339d6d5666 CVEs
a3695d49e878eb2ebbf4645a0975cb5e225fbc7d6 CVEs
b3ad2be890e86c69cdc661739c74b677b46a53cb6 CVEs
dc83dee9003edfff53f0f7d057bf79650c7f10dc6 CVEs
b51be55fe5488a090f6b12200987f4c7afe8cfd35 CVEs
fdeadcd9ba0627cf1967220489ab6caa031e4034

Find a version

213 CVEs

Sort

Information Leak of Memory in getimagesize
CVE-2025-14177
Public exploit
Patch
CWE-125
Medium · CVSS 6.3
EPSS 0.0% (7th pct)2025-12-27
Heap buffer overflow in array_merge()
CVE-2025-14178
Public exploit
Patch
CWE-787
Medium · CVSS 6.5
EPSS 0.0% (5th pct)2025-12-27
NULL Pointer Dereference in PDO quoting
CVE-2025-14180
Public exploit
Patch
CWE-476
High · CVSS 8.2
EPSS 0.0% (15th pct)2025-12-27
pgsql extension does not check for errors during escaping
CVE-2025-1735
Patch
CWE-476
Medium · CVSS 5.9
EPSS 0.6% (70th pct)2025-07-13
Null byte termination in hostnames
CVE-2025-1220
Public exploit
Patch
CWE-918
Low · CVSS 3.7
EPSS 0.2% (36th pct)2025-07-13
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
CVE-2025-6491
Public exploit
Patch
CWE-476
Medium · CVSS 5.9
EPSS 0.8% (74th pct)2025-07-13
Reference counting in php_request_shutdown causes Use-After-Free
CVE-2024-11235
Public exploit
Patch
CWE-416
Critical · CVSS 9.2
EPSS 0.6% (69th pct)2025-04-04
Stream HTTP wrapper truncates redirect location to 1024 bytes
CVE-2025-1861
Patch
CWE-131
Medium · CVSS 6.3
EPSS 1.0% (78th pct)2025-03-30
Stream HTTP wrapper header check might omit basic auth header
CVE-2025-1736
Patch
CWE-20
Medium · CVSS 6.3
EPSS 0.5% (68th pct)2025-03-30
Streams HTTP wrapper does not fail for headers with invalid name and no colon
CVE-2025-1734
Patch
CWE-20
Medium · CVSS 6.3
EPSS 0.8% (74th pct)2025-03-30
libxml streams use wrong content-type header when requesting a redirected resource
CVE-2025-1219
Public exploit
Patch
CWE-1116
Medium · CVSS 6.3
EPSS 0.1% (26th pct)2025-03-30
Header parser of http stream wrapper does not handle folded headers
CVE-2025-1217
Public exploit
Patch
CWE-20
Medium · CVSS 6.3
EPSS 0.2% (44th pct)2025-03-29
PDO::quote() may return unquoted string
CVE-2022-31631
Public exploit
Patch
CWE-74
Critical · CVSS 9.1
EPSS 0.6% (70th pct)2025-02-12
Medium vulnerability · 2024-11-24
CVE-2024-11233
Patch
CWE-122
Medium · CVSS 4.8
EPSS 0.7% (73th pct)2024-11-24
Medium vulnerability · 2024-11-24
CVE-2024-11234
Patch
CWE-20
Medium · CVSS 4.8
EPSS 1.2% (79th pct)2024-11-24
Critical vulnerability · 2024-11-24
CVE-2024-11236
Patch
CWE-787
Critical · CVSS 9.8
EPSS 0.4% (64th pct)2024-11-24
Leak partial content of the heap through heap buffer over-read in mysqlnd
CVE-2024-8929
Public exploit
Patch
CWE-125
Medium · CVSS 5.8
EPSS 0.7% (72th pct)2024-11-22
OOB access in ldap_escape
CVE-2024-8932
Patch
CWE-787
Critical · CVSS 9.8
EPSS 0.3% (58th pct)2024-11-22
PHP-FPM logs from children may be altered
CVE-2024-9026
Public exploit
Patch
CWE-158
Low · CVSS 3.3
EPSS 0.7% (72th pct)2024-10-08
cgi.force_redirect configuration is bypassable due to the environment variable collision
CVE-2024-8927
Patch
CWE-1220
High · CVSS 7.5
EPSS 0.3% (57th pct)2024-10-08
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
CVE-2024-8926
Patch
CWE-78
High · CVSS 8.1
EPSS 2.7% (86th pct)2024-10-08
Erroneous parsing of multipart form data
CVE-2024-8925
Public exploit
Patch
CWE-444
Low · CVSS 3.1
EPSS 1.8% (83th pct)2024-10-08
Medium vulnerability · 2024-06-09
CVE-2024-2408
Public exploit
Patch
CWE-203
Medium · CVSS 5.9
EPSS 0.3% (49th pct)2024-06-09
Argument Injection in PHP-CGI
CVE-2024-4577
CISA KEV
Public exploit
Patch
CWE-78
Added to CISA KEV 2024-06-12
Critical · CVSS 10.0
EPSS 94.4% (100th pct)2024-06-09
Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
CVE-2024-5585
Public exploit
Patch
Workaround
CWE-78
High · CVSS 7.7
EPSS 0.9% (76th pct)2024-06-09
Filter bypass in filter_var (FILTER_VALIDATE_URL)
CVE-2024-5458
Public exploit
Patch
CWE-345
Medium · CVSS 5.3
EPSS 3.6% (88th pct)2024-06-09
Command injection via array-ish $command parameter of proc_open()
CVE-2024-1874
Public exploit
Patch
Workaround
CWE-116
Critical · CVSS 9.4
EPSS 68.6% (99th pct)2024-04-29
PHP mb_encode_mimeheader runs endlessly for some inputs
CVE-2024-2757
Public exploit
Patch
CWE-400
High · CVSS 7.5
EPSS 0.6% (71th pct)2024-04-29
Medium vulnerability · 2024-04-29
CVE-2024-3096
Patch
Workaround
CWE-20
Medium · CVSS 6.5
EPSS 1.1% (78th pct)2024-04-29
Medium vulnerability · 2023-11-02
CVE-2022-4900
Patch
CWE-119
Medium · CVSS 6.2
EPSS 0.1% (20th pct)2023-11-02

Showing 30 of 213

php php-src Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Fixed in

Common weakness types

Disclosure activity by year

Other php products

Frequently asked questions

How many CVEs does php php-src have?

How many php php-src CVEs are in CISA KEV?

Are there public exploits for php php-src vulnerabilities?

Which versions of php php-src are affected?

What are the most common weakness types in php php-src CVEs?

How many critical php php-src vulnerabilities are there?

What is the average severity of php php-src CVEs?

References

Track php php-src vulnerabilities