NES for PHP 7 Release Notes

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.1/ (see Installation)

Based on PHP 7.4.33.

This release patches the following CVEs:

• CVE-2022-4900 A flaw in PHP's built-in web server (php -S) can cause a heap buffer overflow when PHP_CLI_SERVER_WORKERS is set to a very large value. - (Medium)
• CVE-2022-31631 A flaw in PHP's PDO SQLite driver can make PDO::quote() return an unquoted or truncated string for inputs of 2 GiB or more, which can lead to SQL injection. - (Critical)
• CVE-2023-0567 A flaw in PHP's crypt() and password_verify() can accept malformed Blowfish ($2y$) hashes, so any password matches such a hash. - (High)
• CVE-2023-0568 A flaw in PHP's path resolution can write one byte past a stack buffer when a resolved path is exactly one byte shorter than the maximum path length. - (High)
• CVE-2023-0662 A flaw in PHP's multipart/form-data parsing lets a single request with very many parts consume excessive CPU and fill the logs, causing a denial of service. The new max_multipart_body_parts setting limits the number of parts. - (High)
• CVE-2023-3247 A flaw in PHP's SOAP client HTTP Digest authentication can send uninitialised stack memory to the server and uses a weak client nonce. - (Low)
• CVE-2023-3823 A flaw in PHP's XML extensions can let another libxml2 user in the same process enable external entity loading, exposing PHP to XML external entity (XXE) attacks. - (High)
• CVE-2023-3824 A flaw in PHP's phar extension can cause a stack buffer overflow when reading a directory of a crafted phar archive. - (Critical)
• CVE-2024-1874 A flaw in PHP's proc_open() on Windows can let an attacker-controlled argument run arbitrary commands through cmd.exe. - (Critical)
• CVE-2024-2756 An incomplete fix for CVE-2022-31629 lets crafted cookie names be turned into __Host- or __Secure- cookies, which can let a network or same-site attacker set cookies the application treats as secure. - (Medium)
• CVE-2024-3096 A flaw in PHP's password_hash() hashes a bcrypt password that starts with a NUL byte as the empty string, so password_verify() accepts an empty password for it. - (Medium)
• CVE-2024-4577 A flaw in PHP's CGI binary on Windows with some code pages can turn query string bytes into command-line options, allowing remote code execution. - (Critical)
• CVE-2024-5458 A flaw in PHP's FILTER_VALIDATE_URL filter can accept URLs with invalid user information when the host is an IPv6 address. - (Medium)
• CVE-2024-5585 An incomplete fix for CVE-2024-1874 lets proc_open() on Windows run a program name with trailing spaces or dots through cmd.exe without escaping. - (High)
• CVE-2024-8925 A flaw in PHP's multipart/form-data parsing can mishandle long boundaries, letting an attacker who controls part of a request body hide or merge form fields. - (Low)
• CVE-2024-8926 An incomplete fix for CVE-2024-4577 lets PHP's CGI binary on Windows with some code page configurations receive command-line options from the query string. - (High)
• CVE-2024-8927 A flaw in PHP's CGI binary lets a client set HTTP_REDIRECT_STATUS with a request header and bypass cgi.force_redirect, which in some configurations allows arbitrary file inclusion. - (High)
• CVE-2024-8929 A flaw in PHP's MySQL native driver lets a hostile MySQL server make the client read past its buffers and return heap memory, possibly other queries' data. - (Medium)
• CVE-2024-8932 A flaw in PHP's ldap_escape() on 32-bit systems can write past its buffer for very long inputs. - (Critical)
• CVE-2024-9026 A flaw in PHP-FPM worker output logging lets a script inject or remove a few characters of the next log message when catch_workers_output is on. - (Low)
• CVE-2024-11233 A flaw in PHP's convert.quoted-printable-decode stream filter can read one byte past its input buffer, which can crash the process or disclose memory. - (Medium)
• CVE-2024-11234 A flaw in PHP's HTTP stream wrapper can let user input add headers or whole requests when a request goes through an HTTP proxy with request_fulluri. - (Medium)
• CVE-2024-11236 A flaw in PHP's PDO dblib and Firebird drivers on 32-bit systems can make PDO::quote() write past its buffer for very long strings. - (Critical)
• CVE-2025-1217 A flaw in PHP's HTTP stream wrapper mishandles folded response headers, so an application can act on the wrong header value, such as the wrong Content-Type. - (Medium)
• CVE-2025-1218 A flaw in PHP's MySQL native driver lets a malicious MySQL server make the client read past the end of a packet. - (Low)
• CVE-2025-1219 A flaw in PHP's libxml stream handling can decode a document loaded over HTTP with the wrong character set when the URL redirects. - (Medium)
• CVE-2025-1220 A flaw in PHP's fsockopen() and socket stream functions ignores everything after a NUL byte in a host name, which can bypass allow-lists and server-side request forgery checks. - (Low)
• CVE-2025-1734 A flaw in PHP's HTTP stream wrapper accepts invalid response header lines, which can make applications accept invalid headers. - (Medium)
• CVE-2025-1735 A flaw in PHP's PostgreSQL extensions ignores escaping errors, so malformed escaped strings can reach queries. - (Medium)
• CVE-2025-1736 A flaw in PHP's HTTP stream wrapper can drop the Basic authentication header or other standard headers when user-supplied headers are separated by a bare line feed. - (Medium)
• CVE-2025-1861 A flaw in PHP's HTTP stream wrapper truncates long redirect locations, so it can follow a different URL than the server sent. - (Medium)
• CVE-2025-6491 A flaw in PHP's SOAP extension can crash the process with a NULL pointer dereference for a SoapVar whose qualified name has a namespace prefix over 2 GB. - (Medium)
• CVE-2025-14178 A flaw in PHP's array_merge() can overflow a heap buffer when the merged arrays hold 2^32 elements or more, which can cause memory corruption. - (Medium)
• CVE-2025-14181 A flaw in PHP's SOAP client lets a malicious SOAP server sending chunked data overflow the client's response buffer. - (Medium)
• CVE-2026-6103 A flaw in PHP's phar extension can misparse a crafted tar archive, causing out-of-bounds reads. - (Medium)
• CVE-2026-6722 A flaw in PHP's SOAP decoder can cause a use-after-free for an apache:Map with duplicate keys, which can lead to memory corruption. - (Critical)
• CVE-2026-6735 A flaw in the PHP-FPM status page prints request URIs unescaped, allowing stored cross-site scripting against whoever views the full status page. - (High)
• CVE-2026-7258 A flaw in many PHP functions, urldecode() among them, passes negative values to C character classification functions, which can cause out-of-bounds reads on some C libraries. - (Medium)
• CVE-2026-7260 A flaw in PHP's phar extension follows tar symlinks without a limit, so an archive with a symlink cycle can crash the process. - (Medium)
• CVE-2026-7261 A flaw in PHP's SOAP server with session persistence can cause a use-after-free when a header handler returns or throws a SoapFault. - (Medium)
• CVE-2026-7262 A flaw in PHP's SOAP decoder can crash the process with a NULL pointer dereference for an apache:Map item without a value. - (Low)
• CVE-2026-7568 A flaw in PHP's metaphone() can read before its buffer for strings of 2 GiB or more. - (Medium)
• CVE-2026-14355 A flaw in PHP's openssl_encrypt() can overflow a heap buffer by up to 8 bytes with AES key wrap with padding. - (Medium)
• CVE-2026-17543 A flaw in PHP's pg_convert() and the pg_insert(), pg_update(), pg_select() and pg_delete() helpers can quote values incorrectly when standard_conforming_strings is on, which can lead to SQL injection. - (High)
• CVE-2026-17545 A flaw in PHP on Windows lets a file name such as CON or NUL open a device instead of a file, which can cause a denial of service. - (Medium)
• CVE-2026-91765 A flaw in PHP's SOAP extension recurses without a limit on deeply nested XML, so an unauthenticated request can crash the process. - (High)
• CVE-2026-91766 A flaw in PHP's HTTP stream wrapper sends Authorization, Cookie and Proxy-Authorization headers to any host a redirect names, leaking credentials. - (Medium)
• CVE-2026-91767 A flaw in PHP's OpenSSL extension can read far past the peer name when matching a crafted wildcard certificate name. - (Medium)
• CVE-2026-91768 A flaw in PHP's FastCGI client check compares only part of an IPv6 address, so other hosts in the same /96 prefix can send FastCGI requests to an allowed pool. - (Medium)
• CVE-2026-91769 A flaw in PHP's OpenSSL extension falls back to a certificate's Common Name when no subjectAltName matches, so a certificate issued for another host can be accepted. - (Medium)
• CVE-2026-92842 A flaw in PHP's convert.* stream filters can put heap memory into the filter output when the line-break-chars option contains a NUL byte. - (Medium)
• CVE-2026-93682 A flaw in PHP's HTTP stream wrapper reads one byte past an empty redirect location, which can change the redirect target. - (Medium)
• CVE-2026-109618 A flaw in PHP's out-of-memory handling can leave request memory half-initialised and corrupt the heap, which is rated as remote code execution. A script that runs out of memory_limit now ends its process. - (Critical)
• CVE-2026-109619 A flaw in PHP's request cleanup can leave global state pointing at freed memory, so a later request in the same process can read it. - (Critical)
• GHSA-4w77-75f9-2c8w A flaw in PHP's built-in web server can cause a heap use-after-free for a request without a Content-Type header. - (Low)
• GHSA-ch8v-r6jh-4vvr A flaw in PHP's FILTER_SANITIZE_ENCODED filter leaves part of its table uninitialised, so whether byte 0xFF is encoded depends on stack contents. - (Low)
• GHSA-wg4p-4hqh-c3g9 A flaw in PHP's xml_parse_into_struct() can read past the end of a tag name when XML_OPTION_SKIP_TAGSTART is larger than the name. - (Low)
• GHSA-www2-q4fc-65wf A flaw in PHP's DNS and network lookup functions ignores everything after a NUL byte in a name, which can bypass checks on the name. - (Low)
• CVE-2026-9672 A flaw in PHP's bundled GD library can read uninitialised stack memory into an image when decoding a crafted GIF, disclosing information.
• CVE-2021-38115 A flaw in PHP's bundled GD library can read uninitialised memory when loading a truncated TGA image, which can cause a denial of service.
• CVE-2021-40812 A flaw in PHP's bundled GD library ignores failed writes in the BMP and WebP writers, which can lead to an out-of-bounds read. - (Medium)
• CVE-2022-1586 A flaw in PHP's bundled PCRE2 library can cause an out-of-bounds read in JIT-compiled caseless matching of Unicode property classes.
• CVE-2022-1587 A flaw in PHP's bundled PCRE2 library can cause an out-of-bounds read in JIT-compiled recursive patterns.
• CVE-2026-89156 A flaw in PHP's bundled PCRE2 library can read before a UTF subject when matching with \X. - (Low)
• CVE-2026-103111 A flaw in PHP's bundled PCRE2 library can write outside the JIT stack for patterns with very many capturing groups and recursion. - (High)
• GHSA-43gg-c3xx-7w7g A flaw in PHP's bundled PCRE2 library on ARM64 can read past the end of the subject in JIT-compiled matching, which can cause a denial of service. - (Low)
• GHSA-m3wq-j48p-jxwh A flaw in the libzip library of the RHEL 8 packages lets a crafted zip archive with colliding entry names slow down opening it. - (Low)
• CVE-2024-2408 The Marvin attack: RSA decryption with PKCS1 v1.5 padding in PHP's openssl_private_decrypt() can leak timing information that lets an attacker decrypt ciphertexts. NES for PHP 7 relies on the system OpenSSL's implicit rejection where the platform provides it; Debian 12's OpenSSL does not. - (Medium)

Upgrade notes

• php -v and PHP_VERSION report 7.4.33-nes, so version_compare(PHP_VERSION, '7.4.33', '>=') is false. PHP_VERSION_ID stays 70433, and extensions built for PHP 7.4 load as before.
• A script that runs out of memory_limit now ends its process: the fatal error goes to stderr (and to error_log when log_errors is on), and no shutdown function runs. php-fpm starts a new worker in its place. Raise memory_limit where a script needs more. This is the mitigation of CVE-2026-109618 and CVE-2026-109619.
• Session upload progress is disabled: session.upload_progress.enabled has no effect.
• The new max_multipart_body_parts setting (the fix of CVE-2023-0662) limits the parts of a multipart/form-data request body. Its default, -1, means max_input_vars plus max_file_uploads; raise it for forms with more fields and files.