End of life / PHP / 8.1 / CVEs
Known CVEs in PHP 8.1
32 known CVEs reach PHP 8.1, the most severe rated CRITICAL. Every one of them publishes an affected range that includes this release.
By severity
- CRITICAL
- 1
- HIGH
- 4
- MEDIUM
- 18
- LOW
- 9
Every advisory that reaches 8.1
| Advisory | Severity | CVSS | Published | Fixed in |
|---|---|---|---|---|
| CVE-2024-1874 Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows | CRITICAL | 9.4 | 11 April 2024 | 8.1.28 |
| CVE-2024-5585 bypass CVE-2024-1874 | HIGH | 7.7 | 9 June 2024 | 8.1.29 |
| CVE-2023-0662 DoS vulnerability when parsing multipart request body | HIGH | 7.5 | 15 February 2023 | 8.1.16 |
| CVE-2024-8929 [Mysqlnd] Leak partial content of the heap through heap buffer over-read | HIGH | - | 21 November 2024 | 8.1.31 |
| CVE-2024-4577 PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI | HIGH | - | 28 September 2024 | 8.1.29 |
| CVE-2025-14178 Heap buffer overflow in array_merge() | MEDIUM | 6.5 | 18 December 2025 | 8.1.34 |
| CVE-2025-14180 NULL Pointer Dereference in PDO quoting | MEDIUM | 6.3 | 18 December 2025 | 8.1.34 |
| CVE-2025-14177 Information Leak of Memory in getimagesize | MEDIUM | 6.3 | 18 December 2025 | 8.1.34 |
| CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | MEDIUM | 5.9 | 3 July 2025 | 8.1.33 |
| CVE-2024-8927 cgi.force_redirect configuration is bypassable due to the environment variable collision | MEDIUM | 5.3 | 27 September 2024 | 8.1.30 |
| CVE-2024-5458 Filter bypass in filter_var (FILTER_VALIDATE_URL) | MEDIUM | 5.3 | 9 June 2024 | 8.1.29 |
| CVE-2024-11233 Single byte overread with convert.quoted-printable-decode filter | MEDIUM | 4.8 | 21 November 2024 | 8.1.31 |
| CVE-2025-1735 pgsql extension does not check for errors during escaping | MEDIUM | - | 3 July 2025 | 8.1.33 |
| CVE-2025-1219 libxml streams use wrong `content-type` header when requesting a redirected resource | MEDIUM | - | 13 March 2025 | 8.1.32 |
| CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header | MEDIUM | - | 13 March 2025 | 8.1.32 |
| CVE-2025-1861 Stream HTTP wrapper truncate redirect location to 1024 bytes | MEDIUM | - | 13 March 2025 | 8.1.32 |
| CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon | MEDIUM | - | 13 March 2025 | 8.1.32 |
| CVE-2025-1217 Header parser of `http` stream wrapper does not handle folded headers | MEDIUM | - | 13 March 2025 | 8.1.32 |
| CVE-2024-8932 OOB access in ldap_escape | MEDIUM | - | 21 November 2024 | 8.1.31 |
| CVE-2024-11234 Configuring a proxy in a stream context might allow for CRLF injection in URIs | MEDIUM | - | 21 November 2024 | 8.1.31 |
| CVE-2024-11236 Integer overflow in the firebird and dblib quoters causing OOB writes | MEDIUM | - | 21 November 2024 | 8.1.31 |
| CVE-2024-8926 PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | MEDIUM | - | 27 September 2024 | 8.1.30 |
| CVE-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix | MEDIUM | - | 11 April 2024 | 8.1.28 |
| CVE-2024-9026 [PHP-FPM] Logs from childrens may be altered | LOW | 3.3 | 27 September 2024 | 8.1.30 |
| CVE-2024-8925 Erroneous parsing of multipart form data | LOW | 3.1 | 27 September 2024 | 8.1.30 |
| GHSA-www2-q4fc-65wf Null byte termination in dns_get_record() | LOW | - | 18 December 2025 | 8.1.34 |
| CVE-2025-1220 Null byte termination in hostnames | LOW | - | 3 July 2025 | 8.1.33 |
| GHSA-wg4p-4hqh-c3g9 Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used | LOW | - | 13 March 2025 | 8.1.32 |
| GHSA-4w77-75f9-2c8w Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface | LOW | - | 21 November 2024 | 8.1.31 |
| CVE-2024-3096 password_verify can erroneously return true, opening ATO risk | LOW | - | 11 April 2024 | 8.1.28 |
| CVE-2023-3247 Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | LOW | - | 12 June 2023 | 8.1.20 |
| CVE-2023-0567 BCrypt hashes erroneously validate if the salt is cut short by `$` | LOW | - | 15 February 2023 | 8.1.16 |
A further 1 advisories publish no version range, so whether they reach 8.1 cannot be determined from the advisory alone.
Support dates for this release
PHP 8.1 end of life carries the support window, the countdown to it and the release to move to next. This one is End of life and leaves support on 31 December 2025.
Vendor sources last checked 23 October 2026, and checked daily. This data last changed on 23 October 2026.
Be told before PHP 8.1 runs out
One email, ahead of the date, and nothing else. No account, no newsletter, and every message carries a link that stops them for good.
This is one release, on one machine, read by hand
You had to already know which release you were on to look this up. StackDrift scans your machines, works out the build each one is running and mails you when a CVE lands on something you have deployed, across every runtime, operating system and kernel underneath your code.
A card is needed to open the trial and nothing is charged until it ends.