In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

Out-of-bounds read in urldecode() on NetBSD

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before ...

Out-of-bounds read in urldecode()

Уязвимость функции urldecode() интерпретатора языка программирования PHP, позволяющая нарушителю вызвать отказ в обслуживании

Important: php:8.2 security update

Important: php:8.2 security update

Important: php:8.3 security update

ELSA-2026-22305: php:8.2 security update (IMPORTANT)

ELSA-2026-22143: php:8.2 security update (IMPORTANT)

ELSA-2026-22142: php:8.3 security update (IMPORTANT)

Important: php security update

ELSA-2026-23388: php security update (IMPORTANT)

Security update for php7

Important: php:7.4 security update

Important: php8.4 security update

ELSA-2026-34354: php:7.4 security update (IMPORTANT)

ELSA-2026-22649: php8.4 security update (IMPORTANT)