5.3
Medium
CVE-2024-5458 In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering…
Description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP 8.3 | earliest → < 8.3.8 | 8.3.8 |
| PHP 8.2 | earliest → < 8.2.20 | 8.2.20 |
| PHP 8.1 | earliest → < 8.1.29 | 8.1.29 |
| PHP 8.3 | 8.3.0 → < 8.3.8 | 8.3.8 |
| PHP 8.2 | 8.2.0 → < 8.2.20 | 8.2.20 |
| PHP 8.1 | 8.1.0 → < 8.1.29 | 8.1.29 |
| PHP 8.0 | 8.0.2 → 8.0.30 | No fix stated |
| PHP 7.4 | 7.4.15 → 7.4.33 | No fix stated |
| PHP 7.3 | 7.3.27 → 7.3.33 | No fix stated |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| fedora | 40 | No fix stated |
References
- github.com github.com
- www.openwall.com www.openwall.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.debian.org lists.debian.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of PHP
The 103 CVEs of PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critical
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Medium
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Medium