Aller au contenu
en Se connecter
3.4 Faible

CVE-2025-1218 The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough…

Description

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

Produits et versions touchés

Produit Versions touchées Corrigé en
PHP 8.5 premières → < 8.5.11 8.5.11
PHP 8.4 premières → < 8.4.26 8.4.26
PHP 8.3 premières → < 8.3.35 8.3.35
PHP 8.2 premières → < 8.2.34 8.2.34

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de PHP

Les 103 CVE de PHP →
CVE-2026-109619 RCE via stale global state 9.2 Critique CVE-2026-109618 RCE via OOM corruption 9.2 Critique CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a… 5.9 Moyenne CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so… 6.5 Moyenne
Suivre cette CVE