Red Hat Security Advisory

RHSA-2026:1429

php:8.3 security update

Released 2026-01-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.29-1.module+el9.7.0+23852+76de6b03.aarch64::php:8.3, php-8.3.29-1.module+el9.7.0+23852+76de6b03.ppc64le::php:8.3 +47

Fixes 3 records

TI-2025-12958 CVE-2025-14180

NULL Pointer Dereference in PDO quoting

HIGH 69

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character se…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00697 Published 2025-12-27 Partial fix · 8.1.34, 8.2.30 +3 CWE-476

TI-2025-12956 CVE-2025-14178

Heap buffer overflow in array_merge()

HIGH 69

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00455 Published 2025-12-27 Fixed in 8.1.34, 8.2.30 +3 CWE-190

TI-2025-12955 CVE-2025-14177

Information Leak of Memory in getimagesize

MEDIUM 61

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) w…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00504 Published 2025-12-27 Partial fix · 8.1.34, 8.2.30 +3 CWE-125