Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-6104

Fixed in a distro release EPSS <1%CVSS 6.3

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

Published 2026-05-10 · CVE record · OSV

Products: PHP Group PHP, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images

Distro releases

ReleasePackageFixed in
AlmaLinux 10php8.48.4.21-1.el10_2
AlmaLinux 10php8.4-bcmath8.4.21-1.el10_2
AlmaLinux 10php8.4-cli8.4.21-1.el10_2
AlmaLinux 10php8.4-common8.4.21-1.el10_2
AlmaLinux 10php8.4-dba8.4.21-1.el10_2
AlmaLinux 10php8.4-dbg8.4.21-1.el10_2
AlmaLinux 10php8.4-devel8.4.21-1.el10_2
AlmaLinux 10php8.4-embedded8.4.21-1.el10_2
AlmaLinux 10php8.4-enchant8.4.21-1.el10_2
AlmaLinux 10php8.4-ffi8.4.21-1.el10_2
AlmaLinux 10php8.4-fpm8.4.21-1.el10_2
AlmaLinux 10php8.4-gd8.4.21-1.el10_2
AlmaLinux 10php8.4-gmp8.4.21-1.el10_2
AlmaLinux 10php8.4-intl8.4.21-1.el10_2
AlmaLinux 10php8.4-ldap8.4.21-1.el10_2
AlmaLinux 10php8.4-mbstring8.4.21-1.el10_2
AlmaLinux 10php8.4-mysqlnd8.4.21-1.el10_2
AlmaLinux 10php8.4-odbc8.4.21-1.el10_2
AlmaLinux 10php8.4-opcache8.4.21-1.el10_2
AlmaLinux 10php8.4-pdo8.4.21-1.el10_2
AlmaLinux 10php8.4-pgsql8.4.21-1.el10_2
AlmaLinux 10php8.4-process8.4.21-1.el10_2
AlmaLinux 10php8.4-snmp8.4.21-1.el10_2
AlmaLinux 10php8.4-soap8.4.21-1.el10_2
AlmaLinux 10php8.4-xml8.4.21-1.el10_2
Debian 13php8.48.4.21-1~deb13u1
Debian 14php8.48.4.21-1
Red Hat Enterprise Linux 10.2php8.40:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-bcmath0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-bcmath-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-cli0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-cli-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-common0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-common-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-dba0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-dba-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-dbg0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-dbg-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-debugsource0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-devel0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-embedded0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-embedded-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-enchant0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-enchant-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-ffi0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-ffi-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-fpm0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-fpm-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-gd0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-gd-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-gmp0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-gmp-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-intl0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-intl-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-ldap0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-ldap-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-mbstring0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-mbstring-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-mysqlnd0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-mysqlnd-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-odbc0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-odbc-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-opcache0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-opcache-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-pdo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-pdo-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-pgsql0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-pgsql-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-process0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-process-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-snmp0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-snmp-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-soap0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-soap-debuginfo0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-xml0:8.4.21-1.el10_2
Red Hat Enterprise Linux 10.2php8.4-xml-debuginfo0:8.4.21-1.el10_2
Rocky Linux 10php8.40:8.4.21-1.el10_2
Ubuntu 22.04 LTSphp8.18.1.2-1ubuntu2.24
Ubuntu 24.04 LTSphp8.38.3.6-0ubuntu0.24.04.9
Ubuntu 25.10php8.48.4.11-1ubuntu1.2
Ubuntu 26.04 LTSphp8.58.5.4-0ubuntu1.1
openSUSE Tumbleweedphp88.5.6-1.1