End of life / PHP / 8.4 / CVEs
Known CVEs in PHP 8.4
43 known CVEs reach PHP 8.4, the most severe rated CRITICAL. Every one of them publishes an affected range that includes this release.
By severity
- CRITICAL
- 2
- HIGH
- 7
- MEDIUM
- 27
- LOW
- 7
Every advisory that reaches 8.4
| Advisory | Severity | CVSS | Published | Fixed in |
|---|---|---|---|---|
| CVE-2026-109618 RCE via OOM corruption | CRITICAL | 9.2 | 21 October 2026 | 8.4.27 |
| CVE-2026-109619 RCE via stale global state | CRITICAL | 9.2 | 21 October 2026 | 8.4.27 |
| CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution | HIGH | 9.4 | 7 May 2026 | 8.4.21 |
| CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings | HIGH | 9.2 | 7 May 2026 | 8.4.21 |
| CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS | HIGH | 8.2 | 2 July 2026 | 8.4.21 |
| CVE-2026-7263 DoS attack via DOMNode::C14N() | HIGH | 8.2 | 7 May 2026 | 8.4.21 |
| CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | HIGH | 7.5 | 24 September 2026 | 8.4.26 |
| CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale | HIGH | - | 30 July 2026 | 8.4.24 |
| CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout | HIGH | - | 30 July 2026 | 8.4.24 |
| CVE-2026-6735 XSS within PHP-FPM status endpoint | MEDIUM | 7.6 | 7 May 2026 | 8.4.21 |
| CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | MEDIUM | 6.9 | 24 September 2026 | 8.4.26 |
| CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | MEDIUM | 6.5 | 24 September 2026 | 8.4.26 |
| CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | MEDIUM | 6.5 | 24 September 2026 | 8.4.26 |
| CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing | MEDIUM | 6.5 | 24 September 2026 | 8.4.26 |
| CVE-2025-14178 Heap buffer overflow in array_merge() | MEDIUM | 6.5 | 18 December 2025 | 8.4.16 |
| CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value> | MEDIUM | 6.3 | 7 May 2026 | 8.4.21 |
| CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault | MEDIUM | 6.3 | 7 May 2026 | 8.4.21 |
| CVE-2026-7258 Out-of-bounds read in urldecode() | MEDIUM | 6.3 | 7 May 2026 | 8.4.21 |
| CVE-2026-6104 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding | MEDIUM | 6.3 | 7 May 2026 | 8.4.21 |
| CVE-2025-14180 NULL Pointer Dereference in PDO quoting | MEDIUM | 6.3 | 18 December 2025 | 8.4.16 |
| CVE-2025-14177 Information Leak of Memory in getimagesize | MEDIUM | 6.3 | 18 December 2025 | 8.4.16 |
| CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | MEDIUM | 5.9 | 24 September 2026 | 8.4.26 |
| CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects | MEDIUM | 5.9 | 24 September 2026 | 8.4.26 |
| CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | MEDIUM | 5.9 | 3 July 2025 | 8.4.10 |
| CVE-2026-7260 Stack overflow in phar with circular symlinks | MEDIUM | 5.5 | 30 July 2026 | 8.4.24 |
| CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header | MEDIUM | 5.3 | 24 September 2026 | 8.4.26 |
| CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD | MEDIUM | 4.8 | 2 July 2026 | 8.4.23 |
| CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch | MEDIUM | 4.3 | 24 September 2026 | 8.4.26 |
| CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | MEDIUM | 4.0 | 24 September 2026 | 8.4.26 |
| CVE-2025-1735 pgsql extension does not check for errors during escaping | MEDIUM | - | 3 July 2025 | 8.4.10 |
| CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free | MEDIUM | - | 13 March 2025 | 8.4.5 |
| CVE-2025-1219 libxml streams use wrong `content-type` header when requesting a redirected resource | MEDIUM | - | 13 March 2025 | 8.4.5 |
| CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header | MEDIUM | - | 13 March 2025 | 8.4.5 |
| CVE-2025-1861 Stream HTTP wrapper truncate redirect location to 1024 bytes | MEDIUM | - | 13 March 2025 | 8.4.5 |
| CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon | MEDIUM | - | 13 March 2025 | 8.4.5 |
| CVE-2025-1217 Header parser of `http` stream wrapper does not handle folded headers | MEDIUM | - | 13 March 2025 | 8.4.5 |
| GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED | LOW | 3.7 | 24 September 2026 | 8.4.25 |
| CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c | LOW | 3.1 | 24 September 2026 | 8.4.26 |
| CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() | LOW | - | 7 May 2026 | 8.4.21 |
| CVE-2026-7568 Signed integer overflow in metaphone() | LOW | - | 7 May 2026 | 8.4.21 |
| GHSA-www2-q4fc-65wf Null byte termination in dns_get_record() | LOW | - | 18 December 2025 | 8.4.16 |
| CVE-2025-1220 Null byte termination in hostnames | LOW | - | 3 July 2025 | 8.4.10 |
| GHSA-wg4p-4hqh-c3g9 Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used | LOW | - | 13 March 2025 | 8.4.5 |
A further 1 advisories publish no version range, so whether they reach 8.4 cannot be determined from the advisory alone.
Support dates for this release
PHP 8.4 end of life carries the support window, the countdown to it and the release to move to next. This one is Supported and leaves support on 31 December 2028.
Vendor sources last checked 23 October 2026, and checked daily. This data last changed on 23 October 2026.
Be told before PHP 8.4 runs out
One email, ahead of the date, and nothing else. No account, no newsletter, and every message carries a link that stops them for good.
This is one release, on one machine, read by hand
You had to already know which release you were on to look this up. StackDrift scans your machines, works out the build each one is running and mails you when a CVE lands on something you have deployed, across every runtime, operating system and kernel underneath your code.
A card is needed to open the trial and nothing is charged until it ends.