Aller au contenu
Se connecter
3.3 Faible

CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it…

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

Produits et versions touchés

Produit Versions touchées Corrigé en
PHP 8.3 premières → < 8.3.12 8.3.12
PHP 8.2 premières → < 8.2.24 8.2.24
PHP 8.1 premières → < 8.1.30 8.1.30
PHP 8.3 8.3.0 → < 8.3.12 8.3.12
PHP 8.2 8.2.0 → < 8.2.24 8.2.24
PHP 8.1 8.1.0 → < 8.1.30 8.1.30

Autres CVE de PHP

Les 103 CVE de PHP →
CVE-2026-109619 RCE via stale global state 9.2 Critique CVE-2026-109618 RCE via OOM corruption 9.2 Critique CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a… 5.9 Moyenne CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so… 6.5 Moyenne
Suivre cette CVE