Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
1733 vulnerabilities by php
CVE-2026-122233 (GCVE-0-2026-122233)
Vulnerability from nvd – Published: 2026-11-04 21:06 – Updated: 2026-11-04 21:06
VLAI
EPSS
VEX
Title
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
Summary
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
Severity
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/php/frankenphp/security/adviso… | vendor-advisory |
| https://github.com/php/frankenphp/commit/3fade63b… | patch |
| https://github.com/php/frankenphp/releases/tag/v1.13.4 | release-notes |
| https://www.vulncheck.com/advisories/frankenphp-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| php | frankenphp |
Affected:
0 , < 1.13.4
(semver)
cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 16:53
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/dunglas/frankenphp",
"product": "frankenphp",
"repo": "https://github.com/php/frankenphp",
"vendor": "php",
"versions": [
{
"lessThan": "1.13.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
}
],
"datePublic": "2026-10-26T16:53:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users\u0027 Set-Cookie or token headers from backend APIs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:06:41.065Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pmvg-8483-mw84)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/frankenphp/security/advisories/GHSA-pmvg-8483-mw84"
},
{
"tags": [
"patch"
],
"url": "https://github.com/php/frankenphp/commit/3fade63bb1c1d246926ed8a00520015f94cdc819"
},
{
"name": "frankenphp v1.13.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/php/frankenphp/releases/tag/v1.13.4"
},
{
"name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-cross-request-response-header-leak-in-worker-mode"
}
],
"title": "FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122233",
"datePublished": "2026-11-04T21:06:41.065Z",
"dateReserved": "2026-11-04T20:51:10.505Z",
"dateUpdated": "2026-11-04T21:06:41.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109619 (GCVE-0-2026-109619)
Vulnerability from nvd – Published: 2026-10-21 13:54 – Updated: 2026-11-05 18:17Title
RCE via stale global state
Summary
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 00:00 UTC
CWE
Assigner
References
19 references
Impacted products
108 products
| Vendor | Product | Version | |
|---|---|---|---|
| PHP Group | PHP |
Affected:
8.2.* , < 8.2.35
(semver)
Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver) |
|
| Siemens | AMIS TS |
Affected:
0 , < *
(custom)
|
|
| Siemens | AX4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
Affected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
Affected:
0 , < *
(custom)
|
|
| Siemens | Building X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | CADRA |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Call stations |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Capital |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Chargesight |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Cloud IC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Devices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect Insights |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X200 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X300 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X500 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | cRSP |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Depotfinity |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR2 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo Optic |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC5 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC7 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | DFMExpress |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V2.0SP9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V3.1SP1 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Management System |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted RTLS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted Space |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox H60 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Rapid |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | HyperLynx |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Insights Hub |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Local Monitoring bt-monitoring-vm |
Affected:
0 , < V20261103
(custom)
|
|
| Siemens | Navigator E&S |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect Electronics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect MOM |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Discrete |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Foundation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Pharma |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Process |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intelligence |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intra Plant Logistics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Quality |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter RDnL |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PACE-Design |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Student Edition |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard & Standard Plus |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Pathway to Learning Engineering |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Polarion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | QuadView |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D Configuration Backend |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flomaster |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flux |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Simlab |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sinteso FS20 EN |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SiPass integrated |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIPORT |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Intrusion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Video |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Solid Edge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 3 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 4 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 7 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power TG |
Affected:
0 , < *
(custom)
|
|
| Siemens | Supply Chain Suite |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Product Cost Management |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Share |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Visualization |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Tecnomatix Plant Simulation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | TestWay |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Valor NPI |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Verischarge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloudHeliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm panels |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm systems and audio matrices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Workplace Experience |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xcargo |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Designer |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition IC Packaging |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Layout Browser |
Unaffected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109619",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:47.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wiz.io/blog/php2shell-php-rce"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://php2shell.delftintellab.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "CVE-2026-109619 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-23T14:07:57.152Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/14"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/15"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/19"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/20"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/4"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "AMIS TS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AX4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX - S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Building X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CADRA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Call stations",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Capital",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Chargesight",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Cloud IC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Devices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect Insights",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X300",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X500",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "cRSP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Depotfinity",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo Optic",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DFMExpress",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V2.0SP9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V3.1SP1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Management System",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted RTLS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted Space",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox H60",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Rapid",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HyperLynx",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Insights Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Local Monitoring bt-monitoring-vm",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V20261103",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Navigator E\u0026S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect Electronics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect MOM",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Discrete",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Foundation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Pharma",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Process",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intelligence",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intra Plant Logistics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Quality",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter RDnL",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PACE-Design",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Student Edition",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard \u0026 Standard Plus",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pathway to Learning Engineering",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Polarion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "QuadView",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D Configuration Backend",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flomaster",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flux",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Simlab",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sinteso FS20 EN",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SiPass integrated",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPORT",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Intrusion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Video",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power TG",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Supply Chain Suite",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Product Cost Management",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Share",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Tecnomatix Plant Simulation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "TestWay",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Valor NPI",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Verischarge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloudHeliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm panels",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm systems and audio matrices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Workplace Experience",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xcargo",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Designer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition IC Packaging",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Layout Browser",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:17:39.997Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "php-src",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.35",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.36",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.27",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.12",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Wiz"
},
{
"lang": "en",
"type": "reporter",
"value": "Ryan at Calif.io"
},
{
"lang": "en",
"type": "reporter",
"value": "OpenAI"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ilija Tovilo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
}
],
"value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
}
],
"impacts": [
{
"capecId": "CAPEC-234",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-234 Hijacking a privileged process"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of uninitialized pointer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325 Improperly controlled sequential memory allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1419",
"description": "CWE-1419 Incorrect Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:54:43.866Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RCE via stale global state",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-109619",
"datePublished": "2026-10-21T13:54:43.866Z",
"dateReserved": "2026-10-12T21:04:00.504Z",
"dateUpdated": "2026-11-05T18:17:39.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109618 (GCVE-0-2026-109618)
Vulnerability from nvd – Published: 2026-10-21 13:48 – Updated: 2026-11-05 18:17Title
RCE via OOM corruption
Summary
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 00:00 UTC
CWE
Assigner
References
11 references
Impacted products
107 products
| Vendor | Product | Version | |
|---|---|---|---|
| PHP Group | PHP |
Affected:
8.2.* , < 8.2.35
(semver)
Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver) |
|
| Siemens | AMIS TS |
Affected:
0 , < *
(custom)
|
|
| Siemens | AX4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
Affected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
Affected:
0 , < *
(custom)
|
|
| Siemens | Building X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | CADRA |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Call stations |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Capital |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Chargesight |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Cloud IC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Devices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect Insights |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X200 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X300 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X500 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | cRSP |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Depotfinity |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR2 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo Optic |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC5 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC7 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | DFMExpress |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V2.0SP9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V3.1SP1 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Management System |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted RTLS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted Space |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox H60 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Rapid |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | HyperLynx |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Insights Hub |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Local Monitoring bt-monitoring-vm |
Affected:
0 , < V20261103
(custom)
|
|
| Siemens | Navigator E&S |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect Electronics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect MOM |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Discrete |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Foundation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Pharma |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Process |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intelligence |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intra Plant Logistics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Quality |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter RDnL |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PACE-Design |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Student Edition |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard & Standard Plus |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Pathway to Learning Engineering |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Polarion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | QuadView |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D Configuration Backend |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flomaster |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flux |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Simlab |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sinteso FS20 EN |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SiPass integrated |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIPORT |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Intrusion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Video |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Solid Edge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 4 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 7 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power TG |
Affected:
0 , < *
(custom)
|
|
| Siemens | Supply Chain Suite |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Product Cost Management |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Share |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Visualization |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Tecnomatix Plant Simulation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | TestWay |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Valor NPI |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Verischarge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloudHeliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm panels |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm systems and audio matrices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Workplace Experience |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xcargo |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Designer |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition IC Packaging |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Layout Browser |
Unaffected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109618",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:46.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wiz.io/blog/php2shell-php-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://php2shell.delftintellab.com"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "CVE-2026-109618 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-29T06:08:47.615Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/5"
},
{
"url": "http://seclists.org/fulldisclosure/2026/Oct/51"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "AMIS TS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AX4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX - S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Building X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CADRA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Call stations",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Capital",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Chargesight",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Cloud IC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Devices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect Insights",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X300",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X500",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "cRSP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Depotfinity",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo Optic",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DFMExpress",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V2.0SP9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V3.1SP1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Management System",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted RTLS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted Space",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox H60",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Rapid",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HyperLynx",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Insights Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Local Monitoring bt-monitoring-vm",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V20261103",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Navigator E\u0026S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect Electronics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect MOM",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Discrete",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Foundation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Pharma",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Process",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intelligence",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intra Plant Logistics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Quality",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter RDnL",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PACE-Design",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Student Edition",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard \u0026 Standard Plus",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pathway to Learning Engineering",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Polarion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "QuadView",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D Configuration Backend",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flomaster",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flux",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Simlab",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sinteso FS20 EN",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SiPass integrated",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPORT",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Intrusion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Video",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power TG",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Supply Chain Suite",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Product Cost Management",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Share",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Tecnomatix Plant Simulation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "TestWay",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Valor NPI",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Verischarge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloudHeliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm panels",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm systems and audio matrices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Workplace Experience",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xcargo",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Designer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition IC Packaging",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Layout Browser",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:17:38.313Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "php-src",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.35",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.36",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.27",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.12",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ryan at Calif.io"
},
{
"lang": "en",
"type": "reporter",
"value": "Wiz"
},
{
"lang": "en",
"type": "finder",
"value": "OpenAI"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ilija Tovilo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
}
],
"value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
}
],
"impacts": [
{
"capecId": "CAPEC-234",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-234 Hijacking a privileged process"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of uninitialized pointer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325 Improperly controlled sequential memory allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1419",
"description": "CWE-1419 Incorrect Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:48:34.845Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RCE via OOM corruption",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-109618",
"datePublished": "2026-10-21T13:48:34.845Z",
"dateReserved": "2026-10-12T21:03:58.117Z",
"dateUpdated": "2026-11-05T18:17:38.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85733 (GCVE-0-2026-85733)
Vulnerability from nvd – Published: 2026-10-13 16:23 – Updated: 2026-10-13 17:15
VLAI
EPSS
VEX
Title
FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
Summary
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:15 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/php/frankenphp/security/adviso… | x_refsource_CONFIRM |
| https://github.com/php/frankenphp/pull/2524 | x_refsource_MISC |
| https://github.com/php/frankenphp/commit/17940ff2… | x_refsource_MISC |
| https://github.com/php/frankenphp/releases/tag/ca… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| php | frankenphp |
Affected:
< 1.12.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:15:07.458586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:15:18.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frankenphp",
"vendor": "php",
"versions": [
{
"status": "affected",
"version": "\u003c 1.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:23:07.177Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/php/frankenphp/security/advisories/GHSA-cj57-c655-p798",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/php/frankenphp/security/advisories/GHSA-cj57-c655-p798"
},
{
"name": "https://github.com/php/frankenphp/pull/2524",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/pull/2524"
},
{
"name": "https://github.com/php/frankenphp/commit/17940ff2ee188a1e48aabd10c095df72b42539e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/commit/17940ff2ee188a1e48aabd10c095df72b42539e0"
},
{
"name": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5"
}
],
"source": {
"advisory": "GHSA-cj57-c655-p798",
"discovery": "UNKNOWN"
},
"title": "FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85733",
"datePublished": "2026-10-13T16:23:07.177Z",
"dateReserved": "2026-09-04T14:50:16.719Z",
"dateUpdated": "2026-10-13T17:15:18.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82416 (GCVE-0-2026-82416)
Vulnerability from nvd – Published: 2026-10-13 16:20 – Updated: 2026-10-13 20:22
VLAI
EPSS
VEX
Title
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Summary
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 20:14 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/php/frankenphp/security/adviso… | x_refsource_CONFIRM |
| https://github.com/php/frankenphp/pull/2523 | x_refsource_MISC |
| https://github.com/php/frankenphp/commit/be24d825… | x_refsource_MISC |
| https://github.com/php/frankenphp/releases/tag/ca… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| php | frankenphp |
Affected:
< 1.12.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:14:13.860672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:22:02.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frankenphp",
"vendor": "php",
"versions": [
{
"status": "affected",
"version": "\u003c 1.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request\u0027s cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client\u0027s identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:20:53.439Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/php/frankenphp/security/advisories/GHSA-v3ph-cgqh-r8p5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/php/frankenphp/security/advisories/GHSA-v3ph-cgqh-r8p5"
},
{
"name": "https://github.com/php/frankenphp/pull/2523",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/pull/2523"
},
{
"name": "https://github.com/php/frankenphp/commit/be24d82531675f90862b8cde1e9fc7e9ee855aa5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/commit/be24d82531675f90862b8cde1e9fc7e9ee855aa5"
},
{
"name": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5"
}
],
"source": {
"advisory": "GHSA-v3ph-cgqh-r8p5",
"discovery": "UNKNOWN"
},
"title": "FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-82416",
"datePublished": "2026-10-13T16:20:53.439Z",
"dateReserved": "2026-08-28T22:00:43.514Z",
"dateUpdated": "2026-10-13T20:22:02.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92842 (GCVE-0-2026-92842)
Vulnerability from nvd – Published: 2026-09-25 21:11 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Summary
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:55.648676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-standard",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@geeknik (GitHub)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe \u003ccode\u003econvert.base64-encode\u003c/code\u003e, \u003ccode\u003econvert.quoted-printable-encode\u003c/code\u003e and \u003ccode\u003econvert.quoted-printable-decode\u003c/code\u003e stream filters accept a \u003ccode\u003eline-break-chars\u003c/code\u003e option whose length is tracked separately from the string itself. The filter constructors duplicate the value with \u003ccode\u003epestrdup()\u003c/code\u003e, which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.\u003c/p\u003e"
}
],
"value": "The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T21:11:57.236Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OOB read / info leak in convert.* stream filters when line-break-chars contains NUL",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-92842",
"datePublished": "2026-09-25T21:11:57.236Z",
"dateReserved": "2026-09-17T02:52:30.905Z",
"dateUpdated": "2026-09-28T13:31:31.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91768 (GCVE-0-2026-91768)
Vulnerability from nvd – Published: 2026-09-25 21:07 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Summary
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:57 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:57:04.931780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "PHP-FPM",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@l8BL (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@OSTIF-Derek (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so \u003ccode\u003elisten.allowed_clients\u003c/code\u003e matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.\u003c/p\u003e"
}
],
"value": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1023",
"description": "CWE-1023",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T21:07:30.950Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91768",
"datePublished": "2026-09-25T21:07:30.950Z",
"dateReserved": "2026-09-15T00:42:30.045Z",
"dateUpdated": "2026-09-28T13:31:31.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91769 (GCVE-0-2026-91769)
Vulnerability from nvd – Published: 2026-09-25 20:59 – Updated: 2026-10-04 16:10
VLAI
EPSS
VEX
Title
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Summary
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
- CWE-297 - Improper validation of certificate with host mismatch
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:47.310384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-openssl",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Cantina (https://www.cantina.security/)"
},
{
"lang": "en",
"type": "reporter",
"value": "David Korczynski"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "reporter",
"value": "@benzdeus (GitHub)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePHP\u0027s OpenSSL stream peer verification checks the certificate\u0027s subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested \u003ccode\u003epeer_name\u003c/code\u003e. A certificate trusted by the client for one name can therefore be used to impersonate another.\u003c/p\u003e"
}
],
"value": "PHP\u0027s OpenSSL stream peer verification checks the certificate\u0027s subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper validation of certificate with host mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-04T16:10:05.639Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "TLS Hostname Verification Falls Back to CN After SAN Mismatch",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91769",
"datePublished": "2026-09-25T20:59:39.727Z",
"dateReserved": "2026-09-15T00:44:10.816Z",
"dateUpdated": "2026-10-04T16:10:05.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91767 (GCVE-0-2026-91767)
Vulnerability from nvd – Published: 2026-09-25 20:53 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Summary
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
Date Public
2026-09-25 20:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:38.307648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-openssl",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohamed Sayed (flex0geek)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
}
],
"datePublic": "2026-09-25T20:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003ephp_openssl_matches_wildcard_name()\u003c/code\u003e in \u003ccode\u003eext/openssl/xp_ssl.c\u003c/code\u003e underflows the length argument passed to \u003ccode\u003ememchr()\u003c/code\u003e when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to \u003ccode\u003eSIZE_MAX\u003c/code\u003e bytes past the end of a heap allocation. The path is reachable from any default client stream, because \u003ccode\u003everify_peer_name\u003c/code\u003e is enabled by default.\u003c/p\u003e"
}
],
"value": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:53:42.587Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91767",
"datePublished": "2026-09-25T20:53:42.587Z",
"dateReserved": "2026-09-15T00:41:16.041Z",
"dateUpdated": "2026-09-28T13:31:31.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91766 (GCVE-0-2026-91766)
Vulnerability from nvd – Published: 2026-09-25 20:40 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
Cross-origin credential leak in HTTP stream wrapper redirects
Summary
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:20.823835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-standard",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@q2a3z (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Tim D\u00fcsterhus"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the \u003ccode\u003ehttp://\u003c/code\u003e stream wrapper follows a redirect it forwards the user-supplied \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eCookie\u003c/code\u003e and \u003ccode\u003eProxy-Authorization\u003c/code\u003e headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 (\u003ca title=\"CVE-2018-1000007\" href=\"https://github.com/advisories/GHSA-g7x2-hrfp-pv5f\"\u003eCVE-2018-1000007\u003c/a\u003e).\u003c/p\u003e"
}
],
"value": "When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:40:25.040Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-origin credential leak in HTTP stream wrapper redirects",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91766",
"datePublished": "2026-09-25T20:40:25.040Z",
"dateReserved": "2026-09-15T00:38:24.146Z",
"dateUpdated": "2026-09-28T13:31:31.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91765 (GCVE-0-2026-91765)
Vulnerability from nvd – Published: 2026-09-25 20:33 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Summary
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:08.183508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:32.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-soap",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ExPatch_LLC"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Daubois"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003ecleanup_xml_node()\u003c/code\u003e in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any \u003ccode\u003eSoapServer\u003c/code\u003e endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.\u003c/p\u003e"
}
],
"value": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-230 Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:33:03.634Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SOAP: Unbounded Recursion in Server-Side cleanup_xml_node",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91765",
"datePublished": "2026-09-25T20:33:03.634Z",
"dateReserved": "2026-09-15T00:34:01.883Z",
"dateUpdated": "2026-09-28T13:31:32.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6103 (GCVE-0-2026-6103)
Vulnerability from nvd – Published: 2026-09-25 20:08 – Updated: 2026-09-25 20:41
VLAI
EPSS
VEX
Title
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Summary
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 20:41 UTC
CWE
- CWE-190 - Integer overflow or wraparound
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6103",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T20:41:05.626504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:41:27.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@arnoldasr (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@Oblivionsage (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@OSTIF-Derek (GitHub)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Weilin Du"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003ephar_tar_number()\u003c/code\u003e parses the octal size field of a TAR header into a \u003ccode\u003euint32_t\u003c/code\u003e with no overflow check. The field is 11 octal digits wide and holds values up to \u003ccode\u003e0x1FFFFFFFF\u003c/code\u003e, so a size above \u003ccode\u003e0xFFFFFFFF\u003c/code\u003e silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that \u003ccode\u003ePharData\u003c/code\u003e reports and extracts as if they were genuine.\u003c/p\u003e"
}
],
"value": "phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92 Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:21:07.070Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-6103",
"datePublished": "2026-09-25T20:08:49.333Z",
"dateReserved": "2026-04-11T04:13:04.238Z",
"dateUpdated": "2026-09-25T20:41:27.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17545 (GCVE-0-2026-17545)
Vulnerability from nvd – Published: 2026-09-25 20:18 – Updated: 2026-09-25 20:43
VLAI
EPSS
VEX
Title
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Summary
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 20:43 UTC
CWE
- CWE-67 - Improper handling of windows device names
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17545",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T20:43:10.043800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:43:34.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@Crispr (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@OSTIF-Derek"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Shivam Mathur"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn Windows, PHP\u0027s filesystem and stream APIs do not reject reserved device names such as \u003ccode\u003eCON\u003c/code\u003e, \u003ccode\u003ePRN\u003c/code\u003e, \u003ccode\u003eAUX\u003c/code\u003e, \u003ccode\u003eNUL\u003c/code\u003e, \u003ccode\u003eCOM1\u003c/code\u003e to \u003ccode\u003eCOM9\u003c/code\u003e, \u003ccode\u003eLPT1\u003c/code\u003e to \u003ccode\u003eLPT9\u003c/code\u003e, \u003ccode\u003eCONIN$\u003c/code\u003e and \u003ccode\u003eCONOUT$\u003c/code\u003e when they appear as a component of a path. An attacker-controlled filename therefore reaches \u003ccode\u003eCreateFileW()\u003c/code\u003e and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.\u003c/p\u003e"
}
],
"value": "On Windows, PHP\u0027s filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."
}
],
"impacts": [
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-67",
"description": "CWE-67 Improper handling of windows device names",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:18:11.288Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-17545",
"datePublished": "2026-09-25T20:18:11.288Z",
"dateReserved": "2026-07-27T10:15:15.310Z",
"dateUpdated": "2026-09-25T20:43:34.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1218 (GCVE-0-2025-1218)
Vulnerability from nvd – Published: 2026-09-25 20:48 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
Various packet overreads in mysqlnd_writeprotocol.c
Summary
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:30.325753Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-mysqlnd",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "reporter",
"value": "@bao00065 (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@cxxz16 (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@TristanInSec (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@OSTIF-Derek (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@HO-9 (GitHub)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "analyst",
"value": "Alexandre Daubois"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.\u003c/p\u003e"
}
],
"value": "The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:48:21.777Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Various packet overreads in mysqlnd_writeprotocol.c",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2025-1218",
"datePublished": "2026-09-25T20:48:21.777Z",
"dateReserved": "2025-02-11T04:49:52.603Z",
"dateUpdated": "2026-09-28T13:31:31.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14181 (GCVE-0-2025-14181)
Vulnerability from nvd – Published: 2026-09-25 20:26 – Updated: 2026-09-25 20:44
VLAI
EPSS
VEX
Title
Integer overflow to buffer overflow in soap HTTP parsing
Summary
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 20:43 UTC
CWE
- CWE-190 - Integer overflow or wraparound
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14181",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T20:43:53.478398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:44:13.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-soap",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.\u003c/p\u003e"
}
],
"value": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."
}
],
"impacts": [
{
"capecId": "CAPEC-128",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-128 Integer Attacks"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:26:45.445Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integer overflow to buffer overflow in soap HTTP parsing",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2025-14181",
"datePublished": "2026-09-25T20:26:45.445Z",
"dateReserved": "2025-12-06T06:46:57.344Z",
"dateUpdated": "2026-09-25T20:44:13.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122233 (GCVE-0-2026-122233)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:06 – Updated: 2026-11-04 21:06
VLAI
EPSS
VEX
Title
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
Summary
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
Severity
CWE
- CWE-488 - Exposure of Data Element to Wrong Session
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/php/frankenphp/security/adviso… | vendor-advisory |
| https://github.com/php/frankenphp/commit/3fade63b… | patch |
| https://github.com/php/frankenphp/releases/tag/v1.13.4 | release-notes |
| https://www.vulncheck.com/advisories/frankenphp-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| php | frankenphp |
Affected:
0 , < 1.13.4
(semver)
cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 16:53
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/dunglas/frankenphp",
"product": "frankenphp",
"repo": "https://github.com/php/frankenphp",
"vendor": "php",
"versions": [
{
"lessThan": "1.13.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
}
],
"datePublic": "2026-10-26T16:53:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users\u0027 Set-Cookie or token headers from backend APIs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:06:41.065Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pmvg-8483-mw84)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/frankenphp/security/advisories/GHSA-pmvg-8483-mw84"
},
{
"tags": [
"patch"
],
"url": "https://github.com/php/frankenphp/commit/3fade63bb1c1d246926ed8a00520015f94cdc819"
},
{
"name": "frankenphp v1.13.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/php/frankenphp/releases/tag/v1.13.4"
},
{
"name": "VulnCheck Advisory: FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-cross-request-response-header-leak-in-worker-mode"
}
],
"title": "FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122233",
"datePublished": "2026-11-04T21:06:41.065Z",
"dateReserved": "2026-11-04T20:51:10.505Z",
"dateUpdated": "2026-11-04T21:06:41.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109619 (GCVE-0-2026-109619)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:54 – Updated: 2026-11-05 18:17Title
RCE via stale global state
Summary
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 00:00 UTC
CWE
Assigner
References
19 references
Impacted products
108 products
| Vendor | Product | Version | |
|---|---|---|---|
| PHP Group | PHP |
Affected:
8.2.* , < 8.2.35
(semver)
Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver) |
|
| Siemens | AMIS TS |
Affected:
0 , < *
(custom)
|
|
| Siemens | AX4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
Affected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
Affected:
0 , < *
(custom)
|
|
| Siemens | Building X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | CADRA |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Call stations |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Capital |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Chargesight |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Cloud IC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Devices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect Insights |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X200 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X300 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X500 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | cRSP |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Depotfinity |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR2 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo Optic |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC5 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC7 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | DFMExpress |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V2.0SP9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V3.1SP1 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Management System |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted RTLS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted Space |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox H60 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Rapid |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | HyperLynx |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Insights Hub |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Local Monitoring bt-monitoring-vm |
Affected:
0 , < V20261103
(custom)
|
|
| Siemens | Navigator E&S |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect Electronics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect MOM |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Discrete |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Foundation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Pharma |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Process |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intelligence |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intra Plant Logistics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Quality |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter RDnL |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PACE-Design |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Student Edition |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard & Standard Plus |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Pathway to Learning Engineering |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Polarion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | QuadView |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D Configuration Backend |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flomaster |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flux |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Simlab |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sinteso FS20 EN |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SiPass integrated |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIPORT |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Intrusion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Video |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Solid Edge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 3 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 4 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 7 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power TG |
Affected:
0 , < *
(custom)
|
|
| Siemens | Supply Chain Suite |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Product Cost Management |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Share |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Visualization |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Tecnomatix Plant Simulation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | TestWay |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Valor NPI |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Verischarge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloudHeliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm panels |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm systems and audio matrices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Workplace Experience |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xcargo |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Designer |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition IC Packaging |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Layout Browser |
Unaffected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109619",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:47.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wiz.io/blog/php2shell-php-rce"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://php2shell.delftintellab.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "CVE-2026-109619 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-23T14:07:57.152Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/14"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/15"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/16"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/19"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/22/20"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/4"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "AMIS TS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AX4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX - S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Building X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CADRA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Call stations",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Capital",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Chargesight",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Cloud IC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Devices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect Insights",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X300",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X500",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "cRSP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Depotfinity",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo Optic",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DFMExpress",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V2.0SP9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V3.1SP1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Management System",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted RTLS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted Space",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox H60",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Rapid",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HyperLynx",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Insights Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Local Monitoring bt-monitoring-vm",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V20261103",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Navigator E\u0026S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect Electronics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect MOM",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Discrete",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Foundation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Pharma",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Process",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intelligence",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intra Plant Logistics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Quality",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter RDnL",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PACE-Design",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Student Edition",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard \u0026 Standard Plus",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pathway to Learning Engineering",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Polarion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "QuadView",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D Configuration Backend",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flomaster",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flux",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Simlab",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sinteso FS20 EN",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SiPass integrated",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPORT",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Intrusion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Video",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power TG",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Supply Chain Suite",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Product Cost Management",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Share",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Tecnomatix Plant Simulation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "TestWay",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Valor NPI",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Verischarge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloudHeliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm panels",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm systems and audio matrices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Workplace Experience",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xcargo",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Designer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition IC Packaging",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Layout Browser",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:17:39.997Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "php-src",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.35",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.36",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.27",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.12",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Wiz"
},
{
"lang": "en",
"type": "reporter",
"value": "Ryan at Calif.io"
},
{
"lang": "en",
"type": "reporter",
"value": "OpenAI"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ilija Tovilo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
}
],
"value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
}
],
"impacts": [
{
"capecId": "CAPEC-234",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-234 Hijacking a privileged process"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of uninitialized pointer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325 Improperly controlled sequential memory allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1419",
"description": "CWE-1419 Incorrect Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:54:43.866Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RCE via stale global state",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-109619",
"datePublished": "2026-10-21T13:54:43.866Z",
"dateReserved": "2026-10-12T21:04:00.504Z",
"dateUpdated": "2026-11-05T18:17:39.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109618 (GCVE-0-2026-109618)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:48 – Updated: 2026-11-05 18:17Title
RCE via OOM corruption
Summary
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 00:00 UTC
CWE
Assigner
References
11 references
Impacted products
107 products
| Vendor | Product | Version | |
|---|---|---|---|
| PHP Group | PHP |
Affected:
8.2.* , < 8.2.35
(semver)
Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver) |
|
| Siemens | AMIS TS |
Affected:
0 , < *
(custom)
|
|
| Siemens | AX4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX |
Affected:
0 , < *
(custom)
|
|
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S |
Affected:
0 , < *
(custom)
|
|
| Siemens | Building X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | CADRA |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Call stations |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Capital |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Chargesight |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Cloud IC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Climatix Devices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect Insights |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X200 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X300 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Connect X500 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | cRSP |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Depotfinity |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Designcenter X Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo CC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR2 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo DXR3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo Optic |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC3 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC4 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC5 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Desigo PXC7 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | DFMExpress |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V2.0SP9 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Engage V3.1SP1 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Energy Management System |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted RTLS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Enlighted Space |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Flex Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox H60 |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Heliox Rapid |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | HyperLynx |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Insights Hub |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Local Monitoring bt-monitoring-vm |
Affected:
0 , < V20261103
(custom)
|
|
| Siemens | Navigator E&S |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Novigo VANSYS core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect Electronics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Connect MOM |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Core |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Discrete |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Foundation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Pharma |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Execution Process |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intelligence |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Intra Plant Logistics |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter Quality |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter RDnL |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Opcenter X |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PACE-Design |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Essentials |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Pro Student Edition |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Professional - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard - XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | PADS Standard & Standard Plus |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Pathway to Learning Engineering |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Polarion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | QuadView |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM APE1808 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sicharge D Configuration Backend |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE FLEX |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SICHARGE UC |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Go |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sifinity Setup |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flomaster |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Flux |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Simcenter Simlab |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Sinteso FS20 EN |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SiPass integrated |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIPORT |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Control Pro |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Intrusion |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Siveillance Video |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Solid Edge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 4 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power 7 |
Affected:
0 , < *
(custom)
|
|
| Siemens | Spectrum Power TG |
Affected:
0 , < *
(custom)
|
|
| Siemens | Supply Chain Suite |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Product Cost Management |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Share |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Teamcenter Visualization |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Tecnomatix Plant Simulation |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | TestWay |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Valor NPI |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Verischarge |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | VersiCloudHeliox Dual Port 60kW |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm panels |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Voice alarm systems and audio matrices |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Workplace Experience |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xcargo |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Designer |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Enterprise XCR |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition IC Packaging |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | Xpedition Layout Browser |
Unaffected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109618",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:46.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wiz.io/blog/php2shell-php-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://php2shell.delftintellab.com"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "CVE-2026-109618 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-29T06:08:47.615Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/23/5"
},
{
"url": "http://seclists.org/fulldisclosure/2026/Oct/51"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "AMIS TS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "AX4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "blueplanet 360 NX3 M6 WM OD IISX - S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Building X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CADRA",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Call stations",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Capital",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Chargesight",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Cloud IC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Climatix Devices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect Insights",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X300",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Connect X500",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "cRSP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Depotfinity",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Designcenter X Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo CC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo DXR3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo Optic",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC3",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC5",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Desigo PXC7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DFMExpress",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V2.0SP9",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Engage V3.1SP1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Energy Management System",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted RTLS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Enlighted Space",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Flex Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox H60",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Heliox Rapid",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "HyperLynx",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Insights Hub",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Local Monitoring bt-monitoring-vm",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V20261103",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Navigator E\u0026S",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Novigo VANSYS core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect Electronics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Connect MOM",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Core",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Discrete",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Foundation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Pharma",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Execution Process",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intelligence",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Intra Plant Logistics",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter Quality",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter RDnL",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Opcenter X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PACE-Design",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Essentials",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Pro Student Edition",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Professional - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard - XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "PADS Standard \u0026 Standard Plus",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Pathway to Learning Engineering",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Polarion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "QuadView",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM APE1808",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sicharge D Configuration Backend",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE FLEX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SICHARGE UC",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Go",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sifinity Setup",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flomaster",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Flux",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Simcenter Simlab",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Sinteso FS20 EN",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SiPass integrated",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPORT",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Control Pro",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Intrusion",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Siveillance Video",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Solid Edge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 4",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power 7",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spectrum Power TG",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Supply Chain Suite",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Product Cost Management",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Share",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Tecnomatix Plant Simulation",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "TestWay",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Valor NPI",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Verischarge",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "VersiCloudHeliox Dual Port 60kW",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm panels",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Voice alarm systems and audio matrices",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Workplace Experience",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xcargo",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Designer",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Enterprise XCR",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition IC Packaging",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Xpedition Layout Browser",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:17:38.313Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "php-src",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.35",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.36",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.27",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.12",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ryan at Calif.io"
},
{
"lang": "en",
"type": "reporter",
"value": "Wiz"
},
{
"lang": "en",
"type": "finder",
"value": "OpenAI"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ilija Tovilo"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
}
],
"value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
}
],
"impacts": [
{
"capecId": "CAPEC-234",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-234 Hijacking a privileged process"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-824",
"description": "CWE-824 Access of uninitialized pointer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1325",
"description": "CWE-1325 Improperly controlled sequential memory allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1419",
"description": "CWE-1419 Incorrect Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:48:34.845Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RCE via OOM corruption",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"value": "Check the GitHub Security Advisory for mitigation strategies."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-109618",
"datePublished": "2026-10-21T13:48:34.845Z",
"dateReserved": "2026-10-12T21:03:58.117Z",
"dateUpdated": "2026-11-05T18:17:38.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85733 (GCVE-0-2026-85733)
Vulnerability from cvelistv5 – Published: 2026-10-13 16:23 – Updated: 2026-10-13 17:15
VLAI
EPSS
VEX
Title
FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
Summary
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:15 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/php/frankenphp/security/adviso… | x_refsource_CONFIRM |
| https://github.com/php/frankenphp/pull/2524 | x_refsource_MISC |
| https://github.com/php/frankenphp/commit/17940ff2… | x_refsource_MISC |
| https://github.com/php/frankenphp/releases/tag/ca… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| php | frankenphp |
Affected:
< 1.12.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:15:07.458586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:15:18.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frankenphp",
"vendor": "php",
"versions": [
{
"status": "affected",
"version": "\u003c 1.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:23:07.177Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/php/frankenphp/security/advisories/GHSA-cj57-c655-p798",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/php/frankenphp/security/advisories/GHSA-cj57-c655-p798"
},
{
"name": "https://github.com/php/frankenphp/pull/2524",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/pull/2524"
},
{
"name": "https://github.com/php/frankenphp/commit/17940ff2ee188a1e48aabd10c095df72b42539e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/commit/17940ff2ee188a1e48aabd10c095df72b42539e0"
},
{
"name": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5"
}
],
"source": {
"advisory": "GHSA-cj57-c655-p798",
"discovery": "UNKNOWN"
},
"title": "FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85733",
"datePublished": "2026-10-13T16:23:07.177Z",
"dateReserved": "2026-09-04T14:50:16.719Z",
"dateUpdated": "2026-10-13T17:15:18.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82416 (GCVE-0-2026-82416)
Vulnerability from cvelistv5 – Published: 2026-10-13 16:20 – Updated: 2026-10-13 20:22
VLAI
EPSS
VEX
Title
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Summary
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 20:14 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/php/frankenphp/security/adviso… | x_refsource_CONFIRM |
| https://github.com/php/frankenphp/pull/2523 | x_refsource_MISC |
| https://github.com/php/frankenphp/commit/be24d825… | x_refsource_MISC |
| https://github.com/php/frankenphp/releases/tag/ca… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| php | frankenphp |
Affected:
< 1.12.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:14:13.860672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:22:02.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frankenphp",
"vendor": "php",
"versions": [
{
"status": "affected",
"version": "\u003c 1.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request\u0027s cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client\u0027s identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-488",
"description": "CWE-488: Exposure of Data Element to Wrong Session",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:20:53.439Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/php/frankenphp/security/advisories/GHSA-v3ph-cgqh-r8p5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/php/frankenphp/security/advisories/GHSA-v3ph-cgqh-r8p5"
},
{
"name": "https://github.com/php/frankenphp/pull/2523",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/pull/2523"
},
{
"name": "https://github.com/php/frankenphp/commit/be24d82531675f90862b8cde1e9fc7e9ee855aa5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/commit/be24d82531675f90862b8cde1e9fc7e9ee855aa5"
},
{
"name": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/php/frankenphp/releases/tag/caddy/v1.12.5"
}
],
"source": {
"advisory": "GHSA-v3ph-cgqh-r8p5",
"discovery": "UNKNOWN"
},
"title": "FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-82416",
"datePublished": "2026-10-13T16:20:53.439Z",
"dateReserved": "2026-08-28T22:00:43.514Z",
"dateUpdated": "2026-10-13T20:22:02.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92842 (GCVE-0-2026-92842)
Vulnerability from cvelistv5 – Published: 2026-09-25 21:11 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Summary
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:55.648676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-standard",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@geeknik (GitHub)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe \u003ccode\u003econvert.base64-encode\u003c/code\u003e, \u003ccode\u003econvert.quoted-printable-encode\u003c/code\u003e and \u003ccode\u003econvert.quoted-printable-decode\u003c/code\u003e stream filters accept a \u003ccode\u003eline-break-chars\u003c/code\u003e option whose length is tracked separately from the string itself. The filter constructors duplicate the value with \u003ccode\u003epestrdup()\u003c/code\u003e, which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.\u003c/p\u003e"
}
],
"value": "The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T21:11:57.236Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OOB read / info leak in convert.* stream filters when line-break-chars contains NUL",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-92842",
"datePublished": "2026-09-25T21:11:57.236Z",
"dateReserved": "2026-09-17T02:52:30.905Z",
"dateUpdated": "2026-09-28T13:31:31.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91768 (GCVE-0-2026-91768)
Vulnerability from cvelistv5 – Published: 2026-09-25 21:07 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Summary
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:57 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:57:04.931780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "PHP-FPM",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@l8BL (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@OSTIF-Derek (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so \u003ccode\u003elisten.allowed_clients\u003c/code\u003e matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.\u003c/p\u003e"
}
],
"value": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1023",
"description": "CWE-1023",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T21:07:30.950Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91768",
"datePublished": "2026-09-25T21:07:30.950Z",
"dateReserved": "2026-09-15T00:42:30.045Z",
"dateUpdated": "2026-09-28T13:31:31.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91769 (GCVE-0-2026-91769)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:59 – Updated: 2026-10-04 16:10
VLAI
EPSS
VEX
Title
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Summary
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
- CWE-297 - Improper validation of certificate with host mismatch
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:47.310384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-openssl",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Cantina (https://www.cantina.security/)"
},
{
"lang": "en",
"type": "reporter",
"value": "David Korczynski"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "reporter",
"value": "@benzdeus (GitHub)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePHP\u0027s OpenSSL stream peer verification checks the certificate\u0027s subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested \u003ccode\u003epeer_name\u003c/code\u003e. A certificate trusted by the client for one name can therefore be used to impersonate another.\u003c/p\u003e"
}
],
"value": "PHP\u0027s OpenSSL stream peer verification checks the certificate\u0027s subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper validation of certificate with host mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-04T16:10:05.639Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "TLS Hostname Verification Falls Back to CN After SAN Mismatch",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91769",
"datePublished": "2026-09-25T20:59:39.727Z",
"dateReserved": "2026-09-15T00:44:10.816Z",
"dateUpdated": "2026-10-04T16:10:05.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91767 (GCVE-0-2026-91767)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:53 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Summary
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
Date Public
2026-09-25 20:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:38.307648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-openssl",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohamed Sayed (flex0geek)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Arnaud Le Blanc"
}
],
"datePublic": "2026-09-25T20:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003ephp_openssl_matches_wildcard_name()\u003c/code\u003e in \u003ccode\u003eext/openssl/xp_ssl.c\u003c/code\u003e underflows the length argument passed to \u003ccode\u003ememchr()\u003c/code\u003e when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to \u003ccode\u003eSIZE_MAX\u003c/code\u003e bytes past the end of a heap allocation. The path is reachable from any default client stream, because \u003ccode\u003everify_peer_name\u003c/code\u003e is enabled by default.\u003c/p\u003e"
}
],
"value": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:53:42.587Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91767",
"datePublished": "2026-09-25T20:53:42.587Z",
"dateReserved": "2026-09-15T00:41:16.041Z",
"dateUpdated": "2026-09-28T13:31:31.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1218 (GCVE-0-2025-1218)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:48 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
Various packet overreads in mysqlnd_writeprotocol.c
Summary
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:30.325753Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-mysqlnd",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "reporter",
"value": "@bao00065 (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@cxxz16 (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@TristanInSec (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@OSTIF-Derek (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "@HO-9 (GitHub)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jakub Zelenka"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "analyst",
"value": "Alexandre Daubois"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.\u003c/p\u003e"
}
],
"value": "The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:48:21.777Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Various packet overreads in mysqlnd_writeprotocol.c",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2025-1218",
"datePublished": "2026-09-25T20:48:21.777Z",
"dateReserved": "2025-02-11T04:49:52.603Z",
"dateUpdated": "2026-09-28T13:31:31.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91766 (GCVE-0-2026-91766)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:40 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
Cross-origin credential leak in HTTP stream wrapper redirects
Summary
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:20.823835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:31.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-standard",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@q2a3z (GitHub)"
},
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Tim D\u00fcsterhus"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Arnaud Le Blanc"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Jakub Zelenka"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the \u003ccode\u003ehttp://\u003c/code\u003e stream wrapper follows a redirect it forwards the user-supplied \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eCookie\u003c/code\u003e and \u003ccode\u003eProxy-Authorization\u003c/code\u003e headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 (\u003ca title=\"CVE-2018-1000007\" href=\"https://github.com/advisories/GHSA-g7x2-hrfp-pv5f\"\u003eCVE-2018-1000007\u003c/a\u003e).\u003c/p\u003e"
}
],
"value": "When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:40:25.040Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-origin credential leak in HTTP stream wrapper redirects",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91766",
"datePublished": "2026-09-25T20:40:25.040Z",
"dateReserved": "2026-09-15T00:38:24.146Z",
"dateUpdated": "2026-09-28T13:31:31.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91765 (GCVE-0-2026-91765)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:33 – Updated: 2026-09-28 13:31
VLAI
EPSS
VEX
Title
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Summary
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 12:56 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T12:56:08.183508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:31:32.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-soap",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ExPatch_LLC"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Alexandre Daubois"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003ccode\u003ecleanup_xml_node()\u003c/code\u003e in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any \u003ccode\u003eSoapServer\u003c/code\u003e endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.\u003c/p\u003e"
}
],
"value": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-230 Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:33:03.634Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SOAP: Unbounded Recursion in Server-Side cleanup_xml_node",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2026-91765",
"datePublished": "2026-09-25T20:33:03.634Z",
"dateReserved": "2026-09-15T00:34:01.883Z",
"dateUpdated": "2026-09-28T13:31:32.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14181 (GCVE-0-2025-14181)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:26 – Updated: 2026-09-25 20:44
VLAI
EPSS
VEX
Title
Integer overflow to buffer overflow in soap HTTP parsing
Summary
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 20:43 UTC
CWE
- CWE-190 - Integer overflow or wraparound
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/php/php-src/security/advisorie… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14181",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T20:43:53.478398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:44:13.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "ext-soap",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.2.34",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.35",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.26",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.11",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nora Dossche"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nora Dossche"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.\u003c/p\u003e"
}
],
"value": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."
}
],
"impacts": [
{
"capecId": "CAPEC-128",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-128 Integer Attacks"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:26:45.445Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Integer overflow to buffer overflow in soap HTTP parsing",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2025-14181",
"datePublished": "2026-09-25T20:26:45.445Z",
"dateReserved": "2025-12-06T06:46:57.344Z",
"dateUpdated": "2026-09-25T20:44:13.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1359
Vulnerability from certfr_avis - Published: 2026-10-21 - Updated: 2026-10-21
De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| PHP | PHP | PHP toutes versions 6.x | ||
| PHP | PHP | PHP toutes versions 8.0.x | ||
| PHP | PHP | PHP versions 8.2.x antérieures à 8.2.35 | ||
| PHP | PHP | PHP versions 8.5.x antérieures à 8.5.12 | ||
| PHP | PHP | PHP toutes versions 8.1.x | ||
| PHP | PHP | PHP toutes versions 7.x | ||
| PHP | PHP | PHP versions 8.4.x antérieures à 8.4.27 | ||
| PHP | PHP | PHP versions 8.3.x antérieures à 8.3.36 | ||
| PHP | PHP | PHP toutes versions 5.x |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PHP toutes versions 6.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 8.0.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.35",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.5.x ant\u00e9rieures \u00e0 8.5.12",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 8.1.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 7.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.4.x ant\u00e9rieures \u00e0 8.4.27",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.36",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 5.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-109619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109619"
},
{
"name": "CVE-2026-109618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109618"
}
],
"initial_release_date": "2026-10-21T00:00:00",
"last_revision_date": "2026-10-21T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 PHP GHSA-6wmf-4rv5-p3rp",
"url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 PHP GHSA-w8hw-w9fx-j79w",
"url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
}
],
"reference": "CERTFR-2026-AVI-1359",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PHP. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans PHP",
"vendor_advisories": [
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-2"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-3"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-1"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-4"
}
]
}
CERTFR-2026-ALE-014
Vulnerability from certfr_alerte - Published: 2026-10-21 - Updated: 2026-10-27
[Mise à jour du 26 octobre 2026]
Le 23 octobre 2026, PHP a publié un avis de sécurité concernant la vulnérabilité CVE-2026-115560. Celle-ci permet une exécution de code arbitraire à distance. L'éditeur estime que les conditions d'exploitation exigent une combinaison d'options de configuration et de code applicatif peu probable. Un correctif sera donc publié à l'occasion du prochain cycle de mises à jour.
Le CERT-FR constate des tentatives d'exploitation des vulnérabilités CVE-2026-109618 et CVE-2026-109619 ciblant des déploiements spécifiques de PHP.
De plus, le CERT-FR incite à la vigilance et rappelle que le langage PHP est utilisé dans de nombreux produits, il est donc important d'appliquer les correctifs dès que ceux-ci seront disponibles. En effet, de nombreux produits sont potentiellement impactés par cette vulnérabilité. On trouvera une liste non exhaustive de cette dernière fournie par le NCSC-NL (php2shell/software/changelog_software_list.md at main · NCSC-NL/php2shell · GitHub)
[Mise à jour du 22 octobre 2026]
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifiques de PHP.
[Mise à jour du 21 octobre 2026]
Les correctifs de sécurité sont disponibles sur le site de l'éditeur. PHP indique que les vulnérabilités CVE-2026-109618 et CVE-2026-109619 permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
[Publication Initiale]
Le 20 octobre 2026, PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC).
L'éditeur n'assure plus le support des versions de PHP 5.x, 7.x, 8.0.x et 8.1.x [1].
Le CERT-FR recommande d'isoler les équipements affectés puis de procéder à la migration vers une version maintenue et avec les derniers correctifs de sécurité dès publication du correctif éditeur.
Contournements provisoires
Seule l'application de la mise à jour permet de vous prémunir contre l'exploitation des vulnérabilités correspondantes.
PHP a publié des mesures de contournements provisoires pour réduire la surface d'attaque des vulnérabilités CVE-2026-109618 et CVE-2026-109619. L'éditeur recommande pour la vulnérabilité CVE-2026-109618 :
* initialiser memory_limit=-1 ;
* définir une valeur faible pour post_max_size ;
* limiter les ressources mémoire utilisable par PHP.
L'éditeur recommande pour la vulnérabilité CVE-2026-109619 :
* initialiser session.upload_progress.enabled=0 et redémarrer chaque processus d'arrière-plan (worker) ;
* si PHP est en version 8.5.x, initialiser fatal_error_backtraces=0 et redémarrer chaque processus d'arrière-plan ;
* supprimer les configurations incorrectes ou obsolètes qui sont appliquées à chaque requête et qui génèrent des messages de diagnostic avant l'initialisation ;
* corriger les erreurs fatales et les délais d'exécution dépassés accessibles aux attaquants.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| PHP | PHP | PHP toutes versions 8.0.x | ||
| PHP | PHP | PHP versions 8.2.x antérieures à 8.2.35 | ||
| PHP | PHP | PHP versions 8.5.x antérieures à 8.5.12 | ||
| PHP | PHP | PHP toutes versions 8.1.x | ||
| PHP | PHP | PHP toutes versions 7.x | ||
| PHP | PHP | PHP versions 8.4.x antérieures à 8.4.27 | ||
| PHP | PHP | PHP versions 8.3.x antérieures à 8.3.36 | ||
| PHP | PHP | PHP toutes versions 5.x |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PHP toutes versions 8.0.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.35",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.5.x ant\u00e9rieures \u00e0 8.5.12",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 8.1.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 7.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.4.x ant\u00e9rieures \u00e0 8.4.27",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.36",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP toutes versions 5.x",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"closed_at": null,
"content": "## Contournements provisoires\nSeule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation des vuln\u00e9rabilit\u00e9s correspondantes.\n\nPHP a publi\u00e9 des mesures de contournements provisoires pour r\u00e9duire la surface d\u0027attaque des vuln\u00e9rabilit\u00e9s CVE-2026-109618 et CVE-2026-109619. L\u0027\u00e9diteur recommande pour la vuln\u00e9rabilit\u00e9 CVE-2026-109618 :\n* initialiser \u003ccode\u003ememory_limit=-1\u003c/code\u003e ;\n* d\u00e9finir une valeur faible pour \u003ccode\u003epost_max_size\u003c/code\u003e ;\n* limiter les ressources m\u00e9moire utilisable par PHP.\n\nL\u0027\u00e9diteur recommande pour la vuln\u00e9rabilit\u00e9 CVE-2026-109619 :\n* initialiser \u003ccode\u003esession.upload_progress.enabled=0\u003c/code\u003e et red\u00e9marrer chaque processus d\u0027arri\u00e8re-plan (*worker*) ;\n* si PHP est en version 8.5.x, initialiser \u003ccode\u003efatal_error_backtraces=0\u003c/code\u003e et red\u00e9marrer chaque processus d\u0027arri\u00e8re-plan ;\n* supprimer les configurations incorrectes ou obsol\u00e8tes qui sont appliqu\u00e9es \u00e0 chaque requ\u00eate et qui g\u00e9n\u00e8rent des messages de diagnostic avant l\u0027initialisation ;\n* corriger les erreurs fatales et les d\u00e9lais d\u0027ex\u00e9cution d\u00e9pass\u00e9s accessibles aux attaquants.\n\n\n## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-109619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109619"
},
{
"name": "CVE-2026-109618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109618"
},
{
"name": "CVE-2026-115560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-115560"
}
],
"initial_release_date": "2026-10-21T00:00:00",
"last_revision_date": "2026-10-27T00:00:00",
"links": [
{
"title": "Avis CERT-FR CERTFR-2026-AVI-1359 du 21 octobre 2026",
"url": "/avis/CERTFR-2026-AVI-1359/"
},
{
"title": "Fiche r\u00e9flexe : Compromission d\u0027un \u00e9quipement de bordure r\u00e9seau - Endiguement",
"url": "https://cert.cyber.gouv.fr/fiche/CERTFR-2025-RFX-002/"
},
{
"title": "D\u00e9p\u00f4t GitHub php2shell du NCSC-NL du 21 octobre 2026 ",
"url": "https://github.com/NCSC-NL/php2shell"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 PHP GHSA-w8hw-w9fx-j79w",
"url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
},
{
"title": "Communication du CERT-EU",
"url": "https://cert.europa.eu/publications/security-advisories/2026-018/"
},
{
"title": "[2] Bulletin de s\u00e9curit\u00e9 PHP GHSA-6wmf-4rv5-p3rp",
"url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
},
{
"title": "[1] Fin de support des versions de PHP",
"url": "https://www.php.net/eol.php"
}
],
"reference": "CERTFR-2026-ALE-014",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-21T00:00:00.000000"
},
{
"description": "Mise \u00e0 jour des risques, des syst\u00e8mes affect\u00e9s et ajout des correctifs de s\u00e9curit\u00e9",
"revision_date": "2026-10-21T00:00:00.000000"
},
{
"description": "Connaissance de preuves de concept, pr\u00e9cision sur les contournements",
"revision_date": "2026-10-22T00:00:00.000000"
},
{
"description": "Ajout de la vuln\u00e9rabilit\u00e9 CVE-2026-115560 et du lien vers le d\u00e9p\u00f4t GitHub du NCSC-NL. ",
"revision_date": "2026-10-26T00:00:00.000000"
},
{
"description": "Pr\u00e9cisions sur les produits affect\u00e9s et rem\u00e9diations associ\u00e9es",
"revision_date": "2026-10-27T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "\u003cspan class=\"important-content\"\u003e**[Mise \u00e0 jour du 26 octobre 2026]**\u003c/span\u003e\u003cbr/\u003e\nLe 23 octobre 2026, PHP a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la vuln\u00e9rabilit\u00e9 CVE-2026-115560. Celle-ci permet une ex\u00e9cution de code arbitraire \u00e0 distance. L\u0027\u00e9diteur estime que les conditions d\u0027exploitation exigent une combinaison d\u0027options de configuration et de code applicatif peu probable. Un correctif sera donc publi\u00e9 \u00e0 l\u0027occasion du prochain cycle de mises \u00e0 jour.\n\nLe CERT-FR constate des tentatives d\u0027exploitation des vuln\u00e9rabilit\u00e9s CVE-2026-109618 et CVE-2026-109619 ciblant des d\u00e9ploiements sp\u00e9cifiques de PHP.\n\nDe plus, le CERT-FR incite \u00e0 la vigilance et rappelle que le langage PHP est utilis\u00e9 dans de nombreux produits, il est donc important d\u0027appliquer les correctifs d\u00e8s que ceux-ci seront disponibles. *En effet, de nombreux produits sont potentiellement impact\u00e9s par cette vuln\u00e9rabilit\u00e9. On trouvera une liste non exhaustive de cette derni\u00e8re fournie par le NCSC-NL (\u003ca href=\"https://github.com/NCSC-NL/php2shell/blob/main/software/changelog_software_list.md\"\u003ephp2shell/software/changelog_software_list.md at main \u00b7 NCSC-NL/php2shell \u00b7 GitHub\u003c/a\u003e)*\n\n\u003cspan\u003e**[Mise \u00e0 jour du 22 octobre 2026]**\u003c/span\u003e\u003cbr/\u003e\nLe CERT-FR a connaissance de preuves de concept pour les vuln\u00e9rabilit\u00e9s CVE-2026-109618 et CVE-2026-109619 pour des d\u00e9ploiements sp\u00e9cifiques de PHP.\n\n**[Mise \u00e0 jour du 21 octobre 2026]**\u003cbr/\u003e\nLes correctifs de s\u00e9curit\u00e9 sont disponibles sur le site de l\u0027\u00e9diteur. PHP indique que les vuln\u00e9rabilit\u00e9s CVE-2026-109618 et CVE-2026-109619 permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\n**[Publication Initiale]**\u003cbr/\u003e\nLe 20 octobre 2026, PHP a publi\u00e9 une communication concernant deux vuln\u00e9rabilit\u00e9s critiques. L\u0027\u00e9diteur annonce la disponibilit\u00e9 des correctifs de s\u00e9curit\u00e9 pour le 21 octobre 2026 \u00e0 16h00 heure de Paris (14h00 UTC).\nL\u0027\u00e9diteur n\u0027assure plus le support des versions de PHP 5.x, 7.x, 8.0.x et 8.1.x [1]. \n\nLe CERT-FR recommande d\u0027isoler les \u00e9quipements affect\u00e9s puis de proc\u00e9der \u00e0 la migration vers une version maintenue et avec les derniers correctifs de s\u00e9curit\u00e9 d\u00e8s publication du correctif \u00e9diteur.",
"title": "[M\u00e0j] Multiples vuln\u00e9rabilit\u00e9s dans PHP",
"vendor_advisories": [
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-2"
},
{
"published_at": "2026-10-23",
"title": "Bulletin de s\u00e9curit\u00e9 PHP CVE-2026-115560",
"url": "https://www.php.net/archive/2026.php#2026-10-23-1"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-3"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-1"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP",
"url": "https://www.php.net/index.php#2026-10-21-4"
},
{
"published_at": "2026-10-20",
"title": "Communication de PHP",
"url": "https://www.php.net/archive/2026.php#2026-10-20-1"
},
{
"published_at": "2026-10-21",
"title": "Bulletin de s\u00e9curit\u00e9 PHP sur les contournements provisoires additionnels",
"url": "https://www.php.net/archive/2026.php#2026-10-21-5"
}
]
}