Aller au contenu
en Se connecter
5.6 Moyenne

CVE-2026-14355 In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD…

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Produits et versions touchés

Produit Versions touchées Corrigé en
PHP 8.5 8.5.0 → < 8.5.8 8.5.8
PHP 8.4 8.4.0 → < 8.4.23 8.4.23
PHP 8.3 8.3.0 → < 8.3.32 8.3.32
PHP 8.2 8.2.0 → < 8.2.32 8.2.32

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de PHP

Les 10 CVE de PHP →
CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it… 3.3 Faible CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used… 7.5 Élevée CVE-2024-8926 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard… 8.1 Élevée CVE-2024-8925 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form… 3.1 Faible
Suivre cette CVE