CVE-2026-7259
Fixed in a distro release EPSS <1%CVSS 2.1
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
Products: PHP Group PHP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | php | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-bcmath | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-cli | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-common | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-dba | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-dbg | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-devel | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-embedded | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-enchant | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-ffi | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-fpm | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-gd | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-gmp | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-intl | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-ldap | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-mbstring | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-mysqlnd | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-odbc | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-opcache | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-pdo | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-pgsql | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-process | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-snmp | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-soap | 8.3.31-1.el10_2 |
| AlmaLinux:10 | php-xml | 8.3.31-1.el10_2 |
| AlmaLinux:9 | php | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-bcmath | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-cli | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-common | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-dba | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-dbg | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-devel | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-embedded | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-enchant | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-ffi | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-fpm | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-gd | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-gmp | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-intl | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-ldap | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-mbstring | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-mysqlnd | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-odbc | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-opcache | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-pdo | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-pgsql | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-process | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-snmp | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-soap | 8.0.30-6.el9_8 |
| AlmaLinux:9 | php-xml | 8.0.30-6.el9_8 |
| Chainguard | php-8.2 | 8.2.31-r0 |
| Debian:12 | php8.2 | 8.2.31-1~deb12u1 |
| Debian:13 | php8.4 | 8.4.21-1~deb13u1 |
| Debian:14 | php8.4 | 8.4.21-1 |
| Red Hat:enterprise_linux:10.2 | php | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-bcmath | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-bcmath-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-cli | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-cli-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-common | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-common-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-dba | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-dba-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-dbg | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-dbg-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-debugsource | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-devel | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-embedded | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-embedded-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-enchant | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-enchant-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-ffi | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-ffi-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-fpm | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-fpm-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-gd | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-gd-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-gmp | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-gmp-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-intl | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-intl-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-ldap | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-ldap-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-mbstring | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-mbstring-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-mysqlnd | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-mysqlnd-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-odbc | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-odbc-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-opcache | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-opcache-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-pdo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-pdo-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-pgsql | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-pgsql-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-process | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-process-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-snmp | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-snmp-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-soap | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-soap-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-xml | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php-xml-debuginfo | 0:8.3.31-1.el10_2 |
| Red Hat:enterprise_linux:9 | php | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-bcmath | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-bcmath-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-cli | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-cli-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-common | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-common-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-dba | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-dba-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-dbg | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-dbg-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-debugsource | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-devel | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-embedded | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-embedded-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-enchant | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-enchant-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-ffi | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-ffi-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-fpm | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-fpm-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-gd | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-gd-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-gmp | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-gmp-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-intl | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-intl-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-ldap | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-ldap-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-mbstring | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-mbstring-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-mysqlnd | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-mysqlnd-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-odbc | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-odbc-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-opcache | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-opcache-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-pdo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-pdo-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-pgsql | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-pgsql-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-process | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-process-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-snmp | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-snmp-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-soap | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-soap-debuginfo | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-xml | 0:8.0.30-6.el9_8 |
| Red Hat:enterprise_linux:9 | php-xml-debuginfo | 0:8.0.30-6.el9_8 |
| Rocky Linux:10 | php | 0:8.3.31-1.el10_2 |
| Rocky Linux:9 | php | 0:8.0.30-6.el9_8 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.24 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.9 |
| Ubuntu:25.10 | php8.4 | 8.4.11-1ubuntu1.2 |
| Ubuntu:26.04:LTS | php8.5 | 8.5.4-0ubuntu1.1 |
| Wolfi | php-8.2 | 8.2.31-r0 |
| openSUSE:Tumbleweed | php8 | 8.5.6-1.1 |