Red Hat Security Advisory

RHSA-2026:1190

php:8.3 security update

Released 2026-01-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.6) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.19-1.module+el9.6.0+23891+2c64b922.2.aarch64::php:8.3, php-8.3.19-1.module+el9.6.0+23891+2c64b922.2.ppc64le::php:8.3 +47

Fixes 2 records

TI-2025-12958 CVE-2025-14180

NULL Pointer Dereference in PDO quoting

HIGH 69

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character se…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00697 Published 2025-12-27 Partial fix · 8.1.34, 8.2.30 +3 CWE-476

TI-2025-12956 CVE-2025-14178

Heap buffer overflow in array_merge()

HIGH 69

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00455 Published 2025-12-27 Fixed in 8.1.34, 8.2.30 +3 CWE-190