NES for PHP 5 Release Notes

Packages: https://registry.nes.herodevs.com/bin/nes/php/v5.6.40-nes-5.6.1/ (see Installation)

Based on PHP 5.6.40.

This release patches the following CVEs:

• CVE-2023-0567 An attacker who could place a malformed bcrypt hash in a password store could make any password validate; a short hash could also cause an out-of-bounds read. - (High)
• CVE-2023-0568 An attacker able to influence a path or working directory of maximum supported length could trigger a one-byte stack overwrite and crash PHP. - (High)
• CVE-2023-0662 An unauthenticated attacker could send excessive multipart form parts to consume CPU and flood warning logs. - (High)
• CVE-2023-3247 A malicious SOAP server could exploit predictable client nonces to make password guessing easier. - (Low)
• CVE-2023-3823 An attacker could make PHP load external entities and disclose local files if another library had enabled libxml global entity-loading defaults. - (High)
• CVE-2023-3824 An attacker-supplied archive with an oversized directory entry could cause a stack overwrite or an out-of-bounds read, potentially allowing code execution. - (Critical)
• CVE-2026-109618 A flaw in PHP's out-of-memory handling can leave request memory half-initialised and corrupt the heap, which is rated as remote code execution. A script that runs out of memory_limit now ends its process. - (Critical)
• CVE-2026-109619 A flaw in PHP's request cleanup can leave global state pointing at freed memory, so a later request in the same process can read it. - (Critical)
• CVE-2026-6722 The SOAP decoder's map of already decoded values (SOAP_GLOBAL(ref_map)) pointed at values it did not hold a reference to. - (Critical)
• CVE-2026-91765 The SOAP extension's XML cleanup, its href lookup and its decoder recursed once per nesting level with no limit, so a message with very deep nesting, or a long or cyclic chain of href references, exhausted the C stack and crashed the process (unauthenticated denial of service). - (High)
• CVE-2025-14181 The SOAP client's HTTP response reader added up chunk sizes in an int and guarded the buffer growth with a check that relies on signed overflow, which optimising compilers remove: a malicious SOAP server sending chunked data could wrap the size (a heap buffer overflow upstream; on PHP 5.6 builds, at least a huge allocation that ends the request). - (Medium)
• CVE-2025-6491 With libxml2 older than 2.13, a node whose name cannot be copied is left without a name, and the SOAP encoder then compared that missing name: a NULL pointer dereference that crashes the process. - (Medium)
• CVE-2025-1735 The escaping functions of pgsql and pdo_pgsql ignored libpq's errors. - (Medium)
• CVE-2026-17543 pg_convert(), and through it pg_insert(), pg_update(), pg_select() and pg_delete(), quoted escaped strings as E'...'. - (High)
• CVE-2024-11236 The dblib and Firebird quoters computed the quoted length in an integer that a long string of single quotes overflowed, so PDO::quote() wrote past its buffer or returned a string with a corrupt length. - (Critical)
• CVE-2026-6103 When reading a tar or phar archive, PHP accepted entry sizes it could not represent (they wrapped around) and skipped the data of regular files only, so the content of other entry types was read as further tar headers. - (Medium)
• CVE-2026-7260 A tar or phar archive whose symbolic links form a cycle made PHP follow the links recursively without limit until the process ran out of stack and crashed (denial of service). - (Medium)
• CVE-2026-91769 When verifying a TLS peer name, PHP checked the certificate's subjectAltName entries and, when none matched, fell back to the certificate's Common Name, which RFC 6125 forbids once the certificate has a DNS, URI or SRV name. - (Medium)
• CVE-2026-91767 Matching a peer name against a wildcard certificate name (for example a*aaaa against aaaa) computed a negative length when the parts around the * overlapped, and the search then read far past the peer name (heap out-of-bounds read); a malicious server's certificate is enough. - (Medium)
• CVE-2026-91768 php-fpm compared an IPv6 client address with the allowed addresses on their first 96 bits only, so any host sharing that prefix with an allowed client could send FastCGI requests to the pool and run scripts with parameters of its choice. - (Medium)
• GHSA-ch8v-r6jh-4vvr FILTER_SANITIZE_ENCODED read an uninitialised entry of its encoding table for byte 0xFF, so that byte could pass through unencoded depending on the stack. - (Low)
• CVE-2026-92842 A line-break-chars option containing a NUL byte, given to the convert.base64-encode, convert.quoted-printable-encode or convert.quoted-printable-decode filter, made the filter copy heap memory past its copy of the option into its output (information disclosure). - (Medium)
• CVE-2019-9638 A crafted image whose maker note is shorter than its declared offset made exif_read_data() and exif_thumbnail() read uninitialised memory past the maker note's value.
• CVE-2019-9639 A second case of the uninitialised read of CVE-2019-9638: a maker note in the default offset mode was processed with an uninitialised data length.
• CVE-2019-9640 A crafted embedded thumbnail made exif_thumbnail() and exif_read_data() read a SOFn segment past the end of the thumbnail data.
• CVE-2019-9641 The IFD bounds checks of TIFF parsing added offsets that could wrap around on a 32-bit size_t, so a crafted TIFF passed them and was read outside the file buffer.
• CVE-2019-11034 A maker note whose directory starts near the end of its value made exif_read_data() read past the buffer (in php_ifd_get32s()): information disclosure or a crash. - (Medium)
• CVE-2019-11035 A tag whose declared size exceeds the bytes the file holds made exif_read_data() copy past the end of the value (heap over-read): information disclosure or a crash. - (Medium)
• CVE-2019-11036 A crafted IFD entry whose position is at or before the offset base made exif_read_data() copy a tag value from outside the buffer (heap over-read in _estrndup()): information disclosure or a crash. - (Medium)
• CVE-2019-11040 A truncated embedded thumbnail made exif_read_data() read a segment length past the end of the thumbnail (in php_jpg_get16()): information disclosure or a crash. - (Medium)
• CVE-2019-9675 Writing a tar-based phar copied a symlink's target into the 100-byte linkname field of the tar header with the target's own length: a stack buffer overflow for a link target of 100 bytes or more.
• CVE-2019-11045 DirectoryIterator, FilesystemIterator, RecursiveDirectoryIterator and GlobIterator accepted a path with a NUL byte and listed the directory named by the part before it, so a check made on the whole string could be bypassed. - (Low)
• CVE-2020-7063 Files added to a tar or zip archive by Phar::buildFromIterator() or buildFromDirectory() were stored with mode 0777, so anyone who extracted the archive got world-writable files. - (Medium)
• CVE-2020-7068 Opening a zip-based phar with an alias registered the alias with a string that had just been freed (use after free): a crash, or reads of freed memory, from a crafted archive. - (Medium)
• CVE-2022-31628 The phar stream wrapper decompressed a gzip or bzip2 phar again for as long as the result was compressed, so a gzip "quine" made it loop forever: denial of service. - (Low)
• CVE-2019-9637 When rename() moved a file to another file system, it copied the file and only then set the copy's owner and mode, so for a moment other local users could read (or write) the copy with the default umask's permissions.
• CVE-2019-11048 The multipart/form-data parser kept part lengths in signed integers, so a file name or field name of 2 GiB or more wrapped negative: the request then made huge allocations and left its uploaded temporary files behind (denial of service, disk exhaustion). - (Medium)
• CVE-2020-7059 Stripping tags from some inputs read past the end of the buffer, through fgetss() and the string.strip_tags stream filter: information disclosure or a crash. - (Medium)
• CVE-2020-7066 get_headers() ignored everything after a NUL byte in the URL, so a URL an application validated as a whole fetched another host. - (Medium)
• CVE-2020-7067 On EBCDIC platforms, urldecode() and rawurldecode() indexed the EBCDIC conversion table with a signed char, reading before it for escapes above %7F. - (High)
• CVE-2020-7070 PHP URL-decoded cookie names, so a cookie set as ..%5F_Host-name by a sibling subdomain or over plain HTTP arrived as $_COOKIE['__Host-name'] and defeated the __Host- and __Secure- prefixes. - (Medium)
• CVE-2020-7071 FILTER_VALIDATE_URL accepted URLs whose userinfo contains characters RFC 3986 forbids, so a URL that passed validation could be resolved by parse_url() or a client to a different host than the application checked. - (Medium)
• CVE-2025-14177 getimagesize() with its $imageinfo argument returned uninitialised heap memory, which can include data freed by the same request, in the APPn entries of a JPEG whose APP segment was shorter than announced or arrived in several reads (a truncated file, or a network stream that delivers the segment in several reads). - (Medium)
• CVE-2019-11043 With a web server configuration that splits PATH_INFO with a regular expression (nginx's fastcgi_split_path_info), a request whose PATH_INFO comes out empty made php-fpm compute a pointer before the PATH_INFO buffer and write a NUL there; public exploits turn this into remote code execution. - (High)
• CVE-2019-11046 bcmath classified digits with isdigit() on a plain char, so with a C library that calls some bytes above 0x7F digits, a crafted number made bc_shift_addsub() read before its buffer. - (Low)
• CVE-2019-13224 The bundled Oniguruma's onig_new_deluxe() converted a pattern between two different encodings into a buffer it then used after freeing.
• CVE-2020-7060 libmbfl's BIG5 decoder indexed its conversion tables with an unchecked second byte, so converting attacker-supplied BIG5 text (mb_convert_encoding(), mb_decode_mimeheader() and the like) read past a global table: information disclosure or a crash. - (Medium)
• CVE-2020-7062 With session.upload_progress.enabled on, a multipart upload whose part had no file name made the session upload progress handler dereference NULL: any client could crash the worker. - (High)
• CVE-2021-21703 php-fpm's root master process followed pointers kept in the shared-memory scoreboard, which every worker can write, so a worker running attacker code could make the master read and write out of bounds and escalate to root. - (High)
• CVE-2019-11038 imagecreatefromxbm() used an uninitialised stack value for a pixel byte it could not parse, so a crafted XBM image disclosed stack memory in its pixels. - (Low)
• CVE-2019-11039 An encoded word that ends in = at the end of the input made iconv_mime_decode() and iconv_mime_decode_headers() step the remaining length below zero and read past the buffer: information disclosure or a crash. - (Medium)
• CVE-2019-11041 A thumbnail shorter than four bytes made exif_read_data() compare its JPEG signature past the end of the thumbnail. - (Medium)
• CVE-2019-11042 A UserComment tag shorter than two bytes made exif_read_data() read a byte-order mark past the end of the value: information disclosure or a crash. - (Medium)
• CVE-2019-11047 A maker note shorter than the camera maker's ID string made exif_read_data() compare the ID past the end of the value (heap over-read): information disclosure or a crash. - (Medium)
• CVE-2019-11050 Each maker note entry was processed with the length of the whole maker note rather than what remains after the entry, so a tag value could be read past the buffer (a use after free under a memory sanitizer). - (Medium)
• CVE-2020-7064 A JPEG whose EXIF section is one byte long made exif_read_data() read the two-byte TIFF byte-order marker past the data, returning one byte of uninitialised memory in the result. - (Medium)
• CVE-2024-3096 A bcrypt password beginning with a NUL byte was hashed as an empty password, so password_verify() could accept an empty password for it. - (Medium)
• CVE-2024-5458 FILTER_VALIDATE_URL accepted URLs with invalid user information when the host was a bracketed IPv6 address, so an application could accept a URL that another parser reads differently. - (Medium)
• CVE-2024-8925 A multipart boundary longer than the parser's read buffer could make PHP merge or drop form fields. - (Low)
• CVE-2024-8927 php-cgi took the client's Redirect-Status request header (HTTP_REDIRECT_STATUS) as proof that the web server had redirected the request, so cgi.force_redirect could be bypassed. - (High)
• CVE-2024-11233 Data ending in a soft line break split across reads made the quoted-printable decoding filter read one byte past its buffer. - (Medium)
• CVE-2024-11234 With a proxy and request_fulluri set in the stream context, carriage returns and line feeds in the URL went into the request line, so an attacker who controls part of the URL could inject headers or whole requests to the proxy. - (Medium)
• CVE-2024-8932 ldap_escape() computed the escaped length without an overflow check; on 32-bit builds a very large value wrapped it, and the escaped string was written past a short buffer. - (Critical)
• GHSA-4w77-75f9-2c8w After a request with a Content-Type header, a request without one reused the freed Content-Type of the previous request (heap use-after-free). - (Low)
• CVE-2026-6735 The full php-fpm status page printed request URIs without escaping, so a request URI an attacker chose could inject script into the page of whoever viewed it. - (High)
• CVE-2026-7261 When a SOAP header handler failed, SoapServer freed the handler object it keeps in the session, and a later request used the freed object. - (Medium)
• CVE-2026-7262 A SOAP apache:Map item without a <value> made the decoder dereference NULL and crash the process. - (Low)
• CVE-2026-14355 With an AES key-wrap-with-padding cipher, openssl_encrypt() sized its output one block too small, and OpenSSL wrote past it (heap overflow). - (Medium)
• CVE-2015-9253 Each php-fpm child took its pool's listening socket as its stdin and accepted connections on it, so a script that made php://stdin non-blocking (directly or through a program it ran) made every child's accept() fail: the master restarted children in an endless loop, using the CPU and filling the log (denial of service).
• CVE-2016-7480 SplObjectStorage::unserialize() checked that a key was an object before it unserialized the key's information, and the information could change the key through a reference from __wakeup(), so the storage kept a non-object as a key.
• CVE-2017-9118 preg_replace() kept the length of its result in an int, so a result longer than 2 GiB wrapped it negative and the next piece of the result was written at that negative offset from its buffer (heap out-of-bounds write).
• CVE-2021-21702 SoapClient dereferenced NULL when a WSDL's XML schema had an attribute or element without the children it expected, so a hostile or spoofed WSDL crashed the process. - (Medium)
• CVE-2021-21704 pdo_firebird trusted lengths and strings in a Firebird server's replies: a stack buffer overflow in firebird_info_cb() (bug 76448) and out-of-bounds reads in firebird_handle_doer(), firebird_stmt_execute() and firebird_fetch_blob() (bugs 76449, 76450 and 76452), so a hostile server, or one an attacker can impersonate, could crash the client or worse. - (Medium)
• CVE-2021-21705 FILTER_VALIDATE_URL accepted URLs whose userinfo contained characters such as a backslash or a second @ (https://example.com:\@test.com/), which clients then sent to a different host than the application checked: server-side request forgery. - (Medium)
• CVE-2021-21706 On Windows, ZipArchive::extractTo() treated only a leading slash as an absolute path, so an entry named with a drive letter or a backslash prefix was written outside the destination directory. - (Medium)
• CVE-2021-21707 The XML functions passed a file path containing a NUL byte to libxml2, which used the part before it (DOMDocument::load(), simplexml_load_file(), XMLReader::open(), SoapClient's WSDL and others), so a path validated as a whole loaded another file. - (Medium)
• CVE-2022-31625 When a parameter of pg_query_params() could not be converted to a string, the function freed an array of parameter strings it had not fully initialised: freeing uninitialised pointers, rated as remote code execution where an attacker controls the parameters. - (High)
• CVE-2022-31626 mysqlnd sized the buffer for its authentication packet by the authentication data alone, without the packet header, so a long password overflowed the heap; an attacker who can make a script connect with a password they choose (database administration tools) can trigger it. - (High)
• CVE-2022-31629 Request variable names that PHP's name mangling turned into __Host- or __Secure- (for example ..Host-) reached $_COOKIE under the prefixed name, so a sibling subdomain or plain HTTP could set a cookie the application trusts as secure. - (Medium)
• CVE-2022-31631 PDO::quote() on an SQLite connection passed 2 * length + 3 to sqlite3_snprintf() as an int, so for a string of about 1 GiB or more the size wrapped and the result could come back unquoted or truncated: SQL injection. - (Critical)
• CVE-2025-1217 The HTTP stream wrapper read each response header line on its own, so a folded header (a continuation line that starts with a space or tab) became a separate bogus header and its folded value was lost: an application could act on the wrong MIME type, Location or other header. - (Medium)
• CVE-2025-1734 The HTTP stream wrapper accepted a response header line without a colon, or with whitespace in its name, and put it in $http_response_header, so a server could get a malformed line past code that reads the headers differently from the client. - (Medium)
• CVE-2025-1736 Before adding its own Authorization, Host, User-Agent, From, Content-Length, Content-Type and Connection headers, the HTTP stream wrapper looked for them in the http context's header option and accepted a match after a bare LF, a space or a tab. - (Medium)
• CVE-2025-1861 The HTTP stream wrapper kept a redirect's Location header, and the URL it built from it, in 1024-byte buffers, so a longer Location was cut and the wrapper followed a different, truncated URL. - (Medium)
• CVE-2026-93682 Upstream's CVE-2025-1861 fix read outside the Location value when a redirect's Location header was empty (a one-character Location was also mishandled, without an out-of-bounds read). - (Medium)
• CVE-2026-91766 The HTTP stream wrapper repeated the http context's header option on every redirect it followed, so Authorization, Cookie and Proxy-Authorization headers meant for one server went to whatever host, port or scheme a redirect named, including an https to http downgrade. - (Medium)
• CVE-2025-1220 fsockopen() and the socket transports behind stream_socket_client() used the host name as a C string, so "localhost\0.example.com" connected to localhost while the application's own checks of the name (parse_url(), allow lists) saw another host. - (Low)
• GHSA-www2-q4fc-65wf dns_get_record(), checkdnsrr(), getmxrr(), getprotobyname(), getservbyname(), getservbyport(), inet_pton() and ip2long(), and on PHP 5.6 also gethostbyname(), gethostbynamel() and gethostbyaddr(), passed their argument to C functions that stop at a NUL byte, so a lookup of "php.net\0aa" resolved php.net while the application's checks saw another name. - (Low)
• CVE-2026-7258 Many functions (urldecode(), quoted_printable_decode(), version_compare(), sscanf(), html_entity_decode(), sprintf() and others) passed a signed char to the ctype.h functions; for a byte >= 0x80 the argument was negative, and C libraries whose tables do not cover negative values (NetBSD) read before the table. - (Medium)
• CVE-2024-8929 A hostile or compromised MySQL server could make mysqlnd read past its packet buffers and hand the bytes to the application, disclosing heap memory that may hold other data: the OK packet message, the LOCAL INFILE file name, a column's default value, every prepared-statement fetch function and the text-protocol row field length. - (Medium)
• CVE-2025-1218 The mysqlnd wire protocol decoders (greeting, OK, EOF, authentication and change user, result set header and fields, prepare response, rows, the sha256 public key exchange) read length-encoded integers and strings without checking that the packet still held them, and the prepared-statement row decoder trusted a field length shorter than its type's layout, so a malicious or impersonated MySQL server could make the client read past the packet buffer. - (Low)
• CVE-2024-2756 The CVE-2022-31629 fix checked request variable names for a mangled __Host- or __Secure- prefix before PHP had finished mangling them, so names such as .[Host- or _[Host- (whose [ becomes _ later) still reached $_COOKIE as __Host- or __Secure- cookies, which a sibling subdomain or plain HTTP could then set. - (Medium)
• CVE-2016-3191 compile_branch() mishandled (*ACCEPT) inside nested parentheses, so compiling such a pattern overflowed a stack buffer.
• CVE-2017-7186 An invalid Unicode property lookup read outside PCRE's tables (denial of service).
• CVE-2020-14155 A large number after (?C in a pattern overflowed an integer when the pattern was compiled.
• CVE-2017-11164 PCRE's interpreter recurses on the C stack once per nested backtracking point, and PHP 5.6's default pcre.recursion_limit (100000) allows far more stack than a process has, so a repeated group on a long subject (/^(a\|b)*$/ on 400000 characters) crashed the process (stack exhaustion) instead of failing.
• CVE-2017-16231 PCRE's interpreter recurses on the C stack once per nested backtracking point, and PHP 5.6's default pcre.recursion_limit (100000) allows far more stack than a process has, so a repeated group on a long subject (/^(a\|b)*$/ on 400000 characters) crashed the process (stack exhaustion) instead of failing. - (Medium)
• CVE-2019-16163 The parser and the compiler recurse once per nesting level of groups, character classes and quantifiers, with no limit, so a deeply nested pattern exhausted the stack.
• CVE-2019-19012 The search range computations added a pattern's match distances to subject pointers before checking them, so on 32-bit builds the address could wrap and the search read outside the subject.
• CVE-2019-19204 In the POSIX basic and grep syntaxes, an escaped interval (\{n,m\}) cut short at the end of the pattern made the parser read past the pattern (heap over-read).
• CVE-2019-19246 Case-insensitive matching compared the case-folded subject with the pattern string without checking the string's end (heap over-read).
• CVE-2014-8117 Magic entries could use named entries without a limit on how many, so a magic list whose entries each use the next several times ran for exponential time (CPU denial of service).
• CVE-2019-18218 cdf_read_property_info() did not limit the number of elements of a CDF_VECTOR property in a CDF (OLE2) document, so a crafted document overflowed a heap buffer by 4 bytes.
• CVE-2026-9672 The GIF LZW decoder of the bundled libgd initialised table[1][0] instead of table[1][i] and left its decoder state on the stack uninitialised, so a crafted GIF that uses a code before defining it read uninitialised stack memory into the image (information disclosure); it also kept decoding after the end code.
• CVE-2016-6911 dynamicGetbuf() copied from its buffer at the current position without checking that the position was inside the buffer, and a seek could leave it before the start (out-of-bounds read). libgd found it through its TIFF reader; PHP's fork reaches the same function through the GD2 reader's seeks.
• CVE-2016-6153 The SQLite advisories of 2016 to 2025 in the library itself (query planner, window functions, ALTER TABLE, JSON, FTS3, printf, concat_ws, the C API): memory corruption, out-of-bounds reads and crashes, mostly reachable by running crafted SQL or opening a crafted database. - (High)
• CVE-2020-12762 JSON-C's printbuf tracked its size in an int, so a JSON string longer than 2 GiB, which JsonIncrementalParser::parse() and parseFile() build up across chunks, overflowed the size check and the next chunk was written past the buffer (heap out-of-bounds write). - (High)
• CVE-2024-2408 The Marvin attack: RSA decryption with PKCS#1 v1.5 padding (OPENSSL_PKCS1_PADDING, the default) reveals through timing whether the padding was valid, so an attacker who can submit many ciphertexts and time the answers can decrypt a ciphertext or forge a signature. - (Medium)

Upgrade notes

• php -v and PHP_VERSION report 5.6.40-nes, so version_compare(PHP_VERSION, '5.6.40', '>=') is false. PHP_VERSION_ID stays 50640, and extensions built for PHP 5.6 load as before.
• A script that runs out of memory_limit now ends its process: the fatal error goes to stderr (and to error_log when log_errors is on), and no shutdown function runs. php-fpm starts a new worker in its place. Raise memory_limit where a script needs more. This is the mitigation of CVE-2026-109618 and CVE-2026-109619.
• Session upload progress is disabled: session.upload_progress.enabled has no effect.