Read the docs
TI-2021-04788 Aliases CVE-2021-21708GHSA-g9qg-rg7j-whhx

UAF due to php_filter_float() failing

Priority MEDIUM 48CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Why it matters now

EPSS 0.03002 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PHP (PHP Group): 7.4.28, 8.0.16, 8.1.3Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHP7.4.x to before 7.4.28; 8.0.X to before 8.0.16; 8.1.X to before 8.1.37.4.28, 8.0.16, 8.1.3Patch availableCNA
  • PHP VendorPHP Group Affected 7.4.x to before 7.4.28; 8.0.X to before 8.0.16; 8.1.X to before 8.1.3 Fixed in 7.4.28, 8.0.16, 8.1.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*7.4.0 to before 7.4.28; 8.0.0 to before 8.0.16; 8.1.0 to before 8.1.3VulnerablePHP
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.4.0 to before 7.4.28; 8.0.0 to before 8.0.16; 8.1.0 to before 8.1.3 Vulnerable ·PHP

Remediation

  • Fix · CNA PHP (PHP Group) Fixed in 7.4.28, 8.0.16, 8.1.3

Red Hat 5 advisories

  • RHSA-2025:3076 Released 2025-03-20 · Red Hat rating Important
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
  • RHSA-2025:3016 Released 2025-03-18 · Red Hat rating Important
    php:7.4 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
  • RHSA-2022:8197 Released 2022-11-15 · Red Hat rating Moderate
    php security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) php-8.0.20-3.el9, php-bcmath-8.0.20-3.el9, php-cli-8.0.20-3.el9 +22
Show 2 more Red Hat advisories
  • RHSA-2022:7628 Released 2022-11-08 · Red Hat rating Moderate
    php:7.4 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47
  • RHSA-2022:7624 Released 2022-11-08 · Red Hat rating Moderate
    php:8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.20-1.module+el8.6.0+13671+84712317.noarch::php:8.0, libzip-1.7.3-1.module+el8.6.0+13671+84712317.aarch64::php:8.0, libzip-1.7.3-1.module+el8.6.0+13671+84712317.ppc64le::php:8.0 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7624, RHSA-2022:7628
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8197
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:3076
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:3016
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2025:3076
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:3016
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2025:3076
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:3016
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21708
  2. 2026-10-03 Alias added: GHSA-g9qg-rg7j-whhx

References

Exploit 1

Advisory 2

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences