7.5
High
CVE-2022-31626 In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd…
Description
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
Affected products and versions
References
- bugs.php.net bugs.php.net
- FEDORA-2022-0a96e5b9b1 lists.fedoraproject.org
- FEDORA-2022-f3fc52428e lists.fedoraproject.org
- DSA-5179 www.debian.org
- security.netapp.com security.netapp.com
- GLSA-202209-20 security.gentoo.org
- [debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of PHP
The 103 CVEs of PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critical
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Medium
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Medium