Skip to content
fr Sign in
9.8 Critical

CVE-2024-11236 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to…

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

Affected products and versions

Product Affected versions Fixed in
PHP 8.3 earliest → < 8.3.14 8.3.14
PHP 8.2 earliest → < 8.2.26 8.2.26
PHP 8.1 earliest → < 8.1.31 8.1.31
php 8.3 8.3.0 → < 8.3.14 8.3.14
php 8.2 8.2.0 → < 8.2.26 8.2.26
php 8.1 8.1.0 → < 8.1.31 8.1.31

References

Timeline

  1. Published
  2. Last modified

Other CVEs of PHP

The 103 CVEs of PHP →
CVE-2026-109619 RCE via stale global state 9.2 Critical CVE-2026-109618 RCE via OOM corruption 9.2 Critical CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a… 5.9 Medium CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so… 6.5 Medium
Track this CVE