Red Hat Security Advisory

RHSA-2026:2799

php security update

Released 2026-02-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) php-8.0.30-5.el9_7, php-bcmath-8.0.30-5.el9_7, php-cli-8.0.30-5.el9_7 +22

Fixes 2 records

TI-2025-12956 CVE-2025-14178

Heap buffer overflow in array_merge()

HIGH 69

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00455 Published 2025-12-27 Fixed in 8.1.34, 8.2.30 +3 CWE-190

TI-2025-12955 CVE-2025-14177

Information Leak of Memory in getimagesize

MEDIUM 61

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) w…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00504 Published 2025-12-27 Partial fix · 8.1.34, 8.2.30 +3 CWE-125