Red Hat Security Advisory

RHSA-2026:1185

php security update

Released 2026-01-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v. 10.0) php-8.3.19-1.el10_0.1, php-bcmath-8.3.19-1.el10_0.1, php-cli-8.3.19-1.el10_0.1 +22

Fixes 2 records

TI-2025-12958 CVE-2025-14180

NULL Pointer Dereference in PDO quoting

HIGH 69

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character se…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00697 Published 2025-12-27 Partial fix · 8.1.34, 8.2.30 +3 CWE-476

TI-2025-12956 CVE-2025-14178

Heap buffer overflow in array_merge()

HIGH 69

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00455 Published 2025-12-27 Fixed in 8.1.34, 8.2.30 +3 CWE-190