NES for PHP 7 Release Notes: PHP 7.2

PHP 7.2

7.2.2 (NES) - October 27, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.2.34-nes-7.2.2/ (see Installation)

Container Images: registry.nes.herodevs.com/nes/php-nes:7.2.34-nes-7.2.2-<variant>-<base> (see Container Images)

Windows: https://registry.nes.herodevs.com/bin/nes/php/v7.2.34-nes-7.2.2/php-v7.2.34-nes-7.2.2.windows.x64.ts.zip (Windows Server 2022, x64; see Windows)

Based on PHP 7.2.34.

This release patches the following CVEs:

• CVE-2021-21706 ZipArchive::extractTo() could extract an entry outside of the destination directory on Windows: php_zip_make_relative_path() kept a drive letter or UNC prefix in an entry name such as C:/evil instead of stripping it (bug 81420). - (Medium)
• CVE-2024-4577 Argument injection: with Apache and php-cgi on Windows with code page 932, 936 or 950, the "best fit" conversion turned some bytes of a query string into -, so options such as -d allow_url_include=1 reached php-cgi and ran arbitrary code. - (Critical)
• CVE-2024-8926 Bypass of the CVE-2024-4577 fix with some non-default Windows code page configurations. - (High)
• CVE-2026-17545 On Windows, a path component such as CON, NUL, AUX, COM1 or LPT1 opens that device instead of a file, so an attacker-chosen file name could make PHP block on or write to a device (denial of service). - (Medium)

Upgrade notes

• Amazon Linux 2: this release adds PHP 7.2 packages for Amazon Linux 2 (x86_64 and aarch64). They replace the packages of the php7.2 amazon-linux-extras topic under the same names, and yum update moves a host to them (see the Amazon Linux 2 page for the commands). NES for PHP fixes PHP and the libraries it carries its own copy of, not Amazon Linux 2's own packages.
• Windows: this release adds a zip of PHP for Windows, the thread-safe x64 build (see the Windows line above for the file and the supported Windows version). It runs PHP from the command line, from IIS through FastCGI and from Apache (php7apache2_4.dll); extensions built for PHP 7.2 (API20170718,TS,VC15) keep loading. It needs Microsoft's Visual C++ Redistributable for Visual Studio 2015-2026 (x64), which the zip does not include. SHASUMS256.txt, signed with the release key, lists the zip; the programs are not Authenticode-signed. The Windows page has the download, verification and installation steps.
• Windows: the zip carries the fixes for the Windows-only vulnerabilities CVE-2024-4577 and CVE-2024-8926 (php-cgi argument injection), CVE-2026-17545 (device names in paths) and CVE-2021-21706 (ZipArchive path traversal on Windows). Every release's zip is tested against CVE-2024-4577 and CVE-2024-8926 before it ships, with the default code page and with the Japanese code page 932 that CVE-2024-4577 needs.
• Windows: the zip bundles OpenSSL 3.5.9 (the legacy provider is in extras\ssl), where other PHP 7.2 zips have OpenSSL 1.1.1. The enchant extension is not in the zip, because PHP 7.2's enchant needs libenchant 1.x. The zip has a CycloneDX SBOM at extras\sbom.cdx.json.
• Containers: this release adds UBI 8 and UBI 9 images (cli, fpm and apache; amd64 and arm64), built from the release's signed RHEL 8 and RHEL 9 packages, next to the Debian 12 ones. Their tags end in -ubi8 and -ubi9.
• Debian 13, Ubuntu 26.04, RHEL 10, Amazon Linux 2023 and the Alpine images follow in a later release.

7.2.1 (NES) - October 27, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.2.34-nes-7.2.1/ (see Installation)

Container Images: registry.nes.herodevs.com/nes/php-nes:7.2.34-nes-7.2.1-<variant>-<base> (see Container Images)

Based on PHP 7.2.34.

This release patches the following CVEs:

• CVE-2026-109618 An out-of-memory error (memory_limit), or an allocation or string size overflow, jumped ("bailed out") out of code that could have left request memory half-initialised, and the request shutdown then worked on that memory: heap corruption, rated as remote code execution. - (Critical)
• CVE-2026-109619 Global state that points into request memory (error and exception handlers and their stacks, request variables, SAPI request information) was not always reset at the end of a request, so a later request in the same process could read or act on freed memory. - (Critical)
• CVE-2020-7071 FILTER_VALIDATE_URL accepted URLs whose userinfo contains characters RFC 3986 forbids, so a URL that passed validation could be resolved by parse_url() or a client to a different host than the application checked (bug 77423). - (Medium)
• CVE-2021-21702 SoapClient dereferenced NULL when a WSDL's XML schema had an attribute or element without the namespace or name it expected, so a hostile or spoofed WSDL crashed the process (bug 80672). - (Medium)
• CVE-2021-21705 FILTER_VALIDATE_URL accepted URLs whose password contained characters such as a backslash or a second @ (https://example.com:\@test.com/), which clients then sent to a different host than the application checked: server-side request forgery (bug 81122). - (Medium)
• CVE-2021-21704 pdo_firebird trusted lengths and strings in a Firebird server's replies: a stack buffer overflow in firebird_info_cb() (bug 76448) and out-of-bounds reads in firebird_handle_doer(), firebird_stmt_execute() and firebird_fetch_blob() (bugs 76449, 76450 and 76452), so a hostile server, or one an attacker can impersonate, could crash the client or worse. - (Medium)
• CVE-2021-21703 php-fpm's root master process trusted indexes and pointers kept in the shared-memory scoreboard, which every worker can write, so a worker running attacker code could make the master read and write out of bounds and escalate to root (bug 81026). - (High)
• CVE-2021-21707 The XML functions passed a file path containing an escaped NUL byte (%00) to libxml2, which unescaped it and used the part before it (DOMDocument::load(), simplexml_load_file(), XMLReader::open() and others), so a path validated as a whole loaded another file (bug 79971). - (Medium)
• CVE-2022-31625 When a parameter of pg_query_params() or pg_send_execute() could not be converted to a string, the function freed an array of parameter strings it had not fully initialised: freeing uninitialised pointers, rated as remote code execution where an attacker controls the parameters (bug 81720). - (High)
• CVE-2022-31626 mysqlnd sized the buffer for its change-authentication packet by the authentication data alone, without the packet header, so a long password overflowed the heap; an attacker who can make a script connect with a password they choose (database administration tools) can trigger it (bug 81719). - (High)
• CVE-2022-31629 Request variable names that PHP's name mangling turned into __Host- or __Secure- (for example ..Host-) reached $_COOKIE under the prefixed name, so a sibling subdomain or plain HTTP could set a cookie the application trusts as secure (bug 81727). - (Medium)
• CVE-2022-31628 The phar stream wrapper decompressed a gzip phar again for as long as the result was compressed, so a gzip "quine" made it loop forever: denial of service (bug 81726). - (Low)
• CVE-2022-37454 The XKCP SHA-3 code (Keccak sponge) that ext/hash bundles could overflow a buffer for inputs near 4 GiB, as partialBlock + byteIOIndex wraps (hash('sha3-*'), hash_update()). - (Critical)
• CVE-2022-31631 PDO::quote() on an SQLite connection passed 2 * length + 3 to sqlite3_snprintf(), whose size is an int; for a string of 2 GiB or more the size wrapped and the result could be unquoted or truncated, which can lead to SQL injection (bug 81740). - (Critical)
• CVE-2023-0567 crypt() and password_verify() accepted a bcrypt hash whose salt is cut short by $, so any password could validate against such a hash, and a two-byte $2 hash made crypt() read past it. - (High)
• CVE-2023-0568 Resolving a path of MAXPATHLEN - 1 bytes and appending a slash wrote one byte past the buffer (open_basedir checks, DOMDocument::loadXML() and XMLReader::XML() with a resolved path or working directory), which can crash PHP. - (High)
• CVE-2023-0662 An unauthenticated attacker could send a multipart form body with a very large number of parts to consume CPU and flood the logs with a warning per extra file. - (High)
• CVE-2023-3247 The client nonce of SOAP HTTP Digest authentication was 31 random bits, and a failure of the random source was not checked, so uninitialised stack memory could be sent to the server; the small nonce also made it easier for a malicious server to precompute responses. - (Low)
• CVE-2023-3824 Reading a directory of a phar archive copied an entry name into the MAXPATHLEN dirent buffer and wrote its terminator past it: a name of MAXPATHLEN - 1 bytes or more caused a stack buffer overflow, and readdir() could return a name without its terminator. - (Critical)
• CVE-2023-3823 The XML parsers inherited libxml2's process-wide parser defaults, so if another library in the process had enabled external entity loading, PHP loaded external entities and could disclose local files. - (High)
• CVE-2024-2756 Incomplete CVE-2022-31629 fix: cookie names with an unmatched [, such as .[Host-test or _[Secure-test, were mangled into __Host-test / __Secure-test after the check that rejects them, so a network or same-site attacker could set an ordinary cookie that the application takes for a __Host- or __Secure- cookie. - (Medium)
• CVE-2024-3096 A bcrypt password starting with a NUL byte was hashed as the empty string, so password_verify() accepted an empty password for that hash (the fix commit names the draft id GHSA-q6x7-frmf-grcw). - (Medium)
• CVE-2024-5458 FILTER_VALIDATE_URL returned success as soon as the host was a bracketed IPv6 address and skipped the userinfo check, so URLs with invalid userinfo were accepted and could be parsed differently later. - (Medium)
• CVE-2024-8925 A multipart boundary longer than the read buffer was not recognised when it was split across reads, so part of a body could be merged into another field or dropped, letting an attacker who controls part of the data hide other fields. - (Low)
• CVE-2024-8927 cgi.force_redirect accepted HTTP_REDIRECT_STATUS, which a client sets with a Redirect-Status: request header, so a request straight to php-cgi passed the check; in some configurations this allows arbitrary file inclusion. - (High)
• CVE-2024-11236 On 32-bit systems the quoted length of a very long string overflowed in the dblib and Firebird quoters, so PDO::quote() wrote past its buffer. - (Critical)
• CVE-2024-11234 With an HTTP proxy in the stream context and request_fulluri, a request URI containing CR/LF from user input could add headers or whole requests sent through the proxy (request smuggling, requests to resources the proxy can reach). - (Medium)
• CVE-2024-8932 On 32-bit systems the length of the escaped string could overflow for an input of about 1.4 GB, so ldap_escape() wrote past its buffer. - (Critical)
• CVE-2024-11233 A chunk ending in =\r made the convert.quoted-printable-decode filter read one byte past its input buffer, which can crash or disclose a byte of memory. - (Medium)
• GHSA-4w77-75f9-2c8w Heap use-after-free: in the CLI built-in web server, a request without Content-Type kept the previous request's content type pointer, freed with that request, and sapi_read_post_data() read it. - (Low)
• CVE-2025-14178 array_merge() summed the sizes of its arguments in 32 bits and sized the result array from the sum, so a very large merge overflowed the allocation and wrote past the end of the heap block. - (Medium)
• CVE-2026-6722 The SOAP apache:Map decoder stored values in its reference map (SOAP_GLOBAL(ref_map)) without holding a reference to them, so a later lookup in the same message used a value freed in between (use-after-free). - (Critical)
• CVE-2026-7261 SoapServer::handle() freed the session-persisted server object when a SOAP header raised a fault or an exception with SOAP_PERSISTENCE_SESSION on, while the session still held it, and a later request used the freed object (use-after-free). - (Medium)
• CVE-2026-7262 The SOAP apache:Map decoder checked the wrong node for NULL, so a map item with a missing <value> element dereferenced a NULL pointer and crashed the process. - (Low)
• CVE-2026-7568 metaphone() indexed its input with a signed int offset while the string length is a size_t, so a very long string overflowed the signed integer and read out of bounds. - (Medium)
• CVE-2026-6735 The PHP-FPM status page printed request URIs and script names without escaping in its HTML and XML output, so a crafted request gave cross-site scripting against whoever opens the status page. - (High)
• CVE-2026-14355 openssl_encrypt() sized its output buffer for a block cipher, too small for the AES key wrap with padding modes (AES-*-WRAP-PAD), so a call wrote past the end of the heap block. - (Medium)
• CVE-2026-9672 The GIF LZW decoder of the bundled libgd (LWZReadByte_(), ReadImage()) read uninitialised stack memory and went out of bounds on a crafted GIF with a repeated clear code.
• CVE-2026-17543 pg_convert() quoted escaped strings so that a backslash broke out of an E'...' literal, giving SQL injection through values a script believes are escaped. - (High)
• CVE-2026-7260 phar_get_link_source() followed the symbolic links of a tar archive recursively without a bound, so a phar with circular symlinks overflowed the stack and crashed the process. - (Medium)
• CVE-2026-91765 The SOAP XML parsing and decoding code (cleanup_xml_node(), master_to_zval_int()) recursed with the nesting depth of the document, or of its href references, so a deeply nested message overflowed the stack and crashed the process. - (High)
• CVE-2025-1217 The HTTP stream wrapper (fopen(), file_get_contents() on http://) mis-parsed a response header folded onto a continuation line, so a malicious server could make the client take part of a header as another. - (Medium)
• CVE-2025-1734 The HTTP stream wrapper accepted response header lines without a colon (and lines with other malformed shapes) as headers, so a malicious server could smuggle a header past the wrapper's checks. - (Medium)
• CVE-2025-1736 The check of user-supplied request headers (the header stream context option) let a header whose name was followed by CR LF inside the value start a new header, so a script that passed untrusted input as a header value could inject request headers. - (Medium)
• CVE-2025-1861 The HTTP stream wrapper kept a redirect's Location header in a buffer of 1024 bytes and truncated a longer one, so a malicious server could make the client follow a different URL than the one it sent. - (Medium)
• CVE-2026-93682 The HTTP stream wrapper read before the start of a redirect's Location header value when that value was empty, an over-read of the response buffer. - (Medium)
• CVE-2026-91766 The HTTP stream wrapper kept the Authorization header (and credentials in the URL, a cookie) when it followed a redirect to another origin, handing them to a server the script never meant to trust. - (Medium)
• CVE-2025-1220 fsockopen(), stream_socket_client() and the stream transports took the part of a host name before a NUL byte as the host and the rest as ignored, so a name such as localhost\0.example.com connected to localhost after a check against the longer name. - (Low)
• GHSA-www2-q4fc-65wf gethostbyname(), gethostbynamel(), gethostbyaddr(), dns_get_record(), checkdnsrr(), getmxrr(), getservbyname(), getprotobyname(), inet_pton() and ip2long() took the part of their argument before a NUL byte, so a name with a NUL byte resolved as a shorter one.
• CVE-2025-6491 SOAP gave libxml2 an over-long XML name for a SoapVar or SoapParam node (a very large namespace prefix or element name); libxml2 then did not set the node's name and serialize_response_call2() compared a NULL name, a NULL pointer dereference. - (Medium)
• CVE-2025-14181 get_http_body() of SoapClient kept the body size of a chunked HTTP response in an int and checked the sum of two chunk sizes for overflow with signed arithmetic, which the compiler may remove: a malicious SOAP server could make the client reallocate a buffer too small for the data it then read into it (heap buffer overflow). - (Medium)
• GHSA-wg4p-4hqh-c3g9 With XML_OPTION_SKIP_TAGSTART set, xml_parse_into_struct() passed tag_name + skip to the info table before checking that the tag name was longer than the skip, an out-of-bounds read of the tag name.
• CVE-2024-8929 mysqlnd trusted lengths in packets from the MySQL server: a malicious server could make the client read past a packet (the OK packet, the result set header, field metadata, LOCAL INFILE and authentication plugin messages, binary and text rows) and return the heap bytes it read to the script. - (Medium)
• CVE-2025-1218 More packet over-reads in the mysqlnd wire protocol, in the fields read from the greeting, OK, EOF, authentication switch, change-user, result set header and prepared statement packets. - (Low)
• CVE-2025-1735 pg_escape_string(), pg_insert(), pg_update(), pg_convert() and the PDO_PgSQL quoter ignored the error PQescapeStringConn reports (for example for bytes invalid in the connection's encoding) and used the half-escaped string in a query, which can leave a value or name improperly escaped. - (Medium)
• CVE-2017-9120 mysqli_real_escape_string() allocated 2 * length bytes without checking the multiplication, which wraps for a string of more than 2 GiB on a 32-bit build and then wrote past the allocation.
• CVE-2026-6103 phar_parse_tarfile() read a tar entry's octal size into 32 bits without checking it, and skipped the data blocks of regular files only, so an oversized size or the data of another entry type was then parsed as further tar headers: a crafted archive could make PHP see entries that other tools do not (archive entry injection, e.g. past a scanner). - (Medium)
• CVE-2026-91767 php_openssl_matches_wildcard_name() checked only the suffix's length, so a certificate wildcard name whose literal parts together were longer than the peer name made the length passed to memchr() wrap and read far past the name (heap out-of-bounds read). - (Medium)
• CVE-2026-91769 Peer verification fell back to the certificate's Common Name whenever no subjectAltName matched, so a certificate whose SAN names another host but whose CN holds the expected name was accepted (RFC 6125 forbids the fallback once a DNS, SRV or URI identity is present). - (Medium)
• CVE-2026-91768 The FastCGI client check compared IPv6 addresses on 12 of 16 bytes, so an allowed address matched a whole /96 prefix and other hosts in it could talk FastCGI to the pool (run scripts with arbitrary parameters). - (Medium)
• GHSA-ch8v-r6jh-4vvr php_filter_encode_url() initialised 255 of the 256 entries of its "must encode" table, so whether byte 0xFF was percent-encoded by FILTER_SANITIZE_ENCODED depended on stack contents. - (Low)
• CVE-2026-92842 The convert.base64-encode and convert.quoted-printable-* filters copied a line-break-chars option with pestrdup(), which stops at a NUL, but kept its full length, so the filter read past its copy and put heap bytes into its output (information disclosure). - (Medium)
• CVE-2026-7258 Many functions (urldecode() among them) passed a signed char to the ctype.h functions; for bytes >= 0x80 the argument was negative, and C libraries whose tables do not cover negative values read out of bounds. - (Medium)
• CVE-2017-9118 preg_replace() and preg_replace_callback() grew their result with an overflow-checked size to which zend_string_alloc() then added the string header, so a result length just under SIZE_MAX wrapped and the copy that followed wrote past the buffer.
• CVE-2017-11164 The bundled PCRE 8.41 was missing the fixes of 8.43 (CVE-2019-20838, a subject over-read in the JIT when UTF is off and \X or \R has more than one fixed quantifier) and 8.44 (CVE-2020-14155, an integer overflow of the callout number in a pattern); upgraded to 8.45, the last PCRE1 release.
• CVE-2019-16163 The bundled Oniguruma 6.3.0 misses the 6.9.2-6.9.4 fixes for five advisories.
• CVE-2019-16168 The bundled SQLite 3.28.0 (April 2019) misses the fixes of every release since, among them the 42 advisories listed for this entry (memory corruption and denial of service in the parser, the query planner, window functions, FTS3 and FTS5, virtual tables and the CLI shell); upgraded to the 3.54.1 amalgamation. - (Medium)
• GHSA-m3wq-j48p-jxwh The bundled libzip indexes entry names with a fixed hash, so an archive can put every entry name into one bucket and make each lookup walk the whole chain (hash flooding, GHSA-m3wq-j48p-jxwh, fixed in libzip 1.12).
• CVE-2021-40812 The bundled libgd's BMP and WebP writers ignored the result of gdPutBuf(), so a short write was not reported, and the BMP writer's error path freed the caller's context instead of its own temporary one. - (Medium)
• CVE-2024-2408 The Marvin attack: RSA decryption with PKCS#1 v1.5 padding (OPENSSL_PKCS1_PADDING, the default) leaks through timing whether the padding was valid, so an attacker who can submit many ciphertexts and time the answers can decrypt a ciphertext or forge a signature. - (Medium)