HeroDevs
Visit NES for PHP Home Page

NES for PHP 7 Release Notes: PHP 7.3

Comprehensive release notes and changelog for NES for PHP 7 Release Notes: PHP 7.3, including security patches, bug fixes, and feature updates across all supported versions.

71 Patched Vulnerabilities
VEX Statements

PHP 7.3

7.3.1 (NES) - October 28, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.3.33-nes-7.3.1/ (see Installation)

Based on PHP 7.3.33.

This release patches the following CVEs:

  • CVE-2022-31625 When a parameter of pg_query_params() or pg_send_execute() could not be converted to a string, the function freed an array of parameter strings it had not fully initialised: freeing uninitialised pointers, rated as remote code execution where an attacker controls the parameters (bug 81720). - (High)
  • CVE-2022-31626 mysqlnd sized the buffer for its change-authentication packet by the authentication data alone, without the packet header, so a long password overflowed the heap; an attacker who can make a script connect with a password they choose (database administration tools) can trigger it (bug 81719). - (High)
  • CVE-2022-31629 Request variable names that PHP's name mangling turned into __Host- or __Secure- (for example ..Host-) reached $_COOKIE under the prefixed name, so a sibling subdomain or plain HTTP could set a cookie the application trusts as secure (bug 81727). - (Medium)
  • CVE-2022-31628 The phar stream wrapper decompressed a gzip phar again for as long as the result was compressed, so a gzip "quine" made it loop forever: denial of service (bug 81726). - (Low)
  • CVE-2022-37454 The XKCP SHA-3 code (Keccak sponge) that ext/hash bundles could overflow a buffer for inputs near 4 GiB, as partialBlock + byteIOIndex wraps (hash('sha3-*'), hash_update()). - (Critical)
  • CVE-2022-31631 PDO::quote() on an SQLite connection passed 2 * length + 3 to sqlite3_snprintf(), whose size is an int; for a string of 2 GiB or more the size wrapped and the result could be unquoted or truncated, which can lead to SQL injection (bug 81740). - (Critical)
  • CVE-2026-109618 An out-of-memory error (memory_limit), or an allocation or string size overflow, jumped ("bailed out") out of code that could have left request memory half-initialised, and the request shutdown then worked on that memory: heap corruption, rated as remote code execution. - (Critical)
  • CVE-2026-109619 Global state that points into request memory (error and exception handlers and their stacks, request variables, SAPI request information) was not always reset at the end of a request, so a later request in the same process could read or act on freed memory. - (Critical)
  • CVE-2023-0567 crypt() and password_verify() accepted a bcrypt hash whose salt is cut short by $, so any password could validate against such a hash, and a two-byte $2 hash made crypt() read past it. - (High)
  • CVE-2023-0568 Resolving a path of MAXPATHLEN - 1 bytes and appending a slash wrote one byte past the buffer (open_basedir checks, DOMDocument::loadXML() and XMLReader::XML() with a resolved path or working directory), which can crash PHP. - (High)
  • CVE-2023-0662 An unauthenticated attacker could send a multipart form body with a very large number of parts to consume CPU and flood the logs with a warning per extra file. - (High)
  • CVE-2023-3247 The client nonce of SOAP HTTP Digest authentication was 31 random bits, and a failure of the random source was not checked, so uninitialised stack memory could be sent to the server; the small nonce also made it easier for a malicious server to precompute responses. - (Low)
  • CVE-2023-3824 Reading a directory of a phar archive copied an entry name into the MAXPATHLEN dirent buffer and wrote its terminator past it: a name of MAXPATHLEN - 1 bytes or more caused a stack buffer overflow, and readdir() could return a name without its terminator. - (Critical)
  • CVE-2023-3823 The XML parsers inherited libxml2's process-wide parser defaults, so if another library in the process had enabled external entity loading, PHP loaded external entities and could disclose local files. - (High)
  • CVE-2024-2756 Incomplete CVE-2022-31629 fix: cookie names with an unmatched [, such as .[Host-test or _[Secure-test, were mangled into __Host-test / __Secure-test after the check that rejects them, so a network or same-site attacker could set an ordinary cookie that the application takes for a __Host- or __Secure- cookie. - (Medium)
  • CVE-2024-3096 A bcrypt password starting with a NUL byte was hashed as the empty string, so password_verify() accepted an empty password for that hash (the fix commit names the draft id GHSA-q6x7-frmf-grcw). - (Medium)
  • CVE-2024-5458 FILTER_VALIDATE_URL returned success as soon as the host was a bracketed IPv6 address and skipped the userinfo check, so URLs with invalid userinfo were accepted and could be parsed differently later. - (Medium)
  • CVE-2024-8925 A multipart boundary longer than the read buffer was not recognised when it was split across reads, so part of a body could be merged into another field or dropped, letting an attacker who controls part of the data hide other fields. - (Low)
  • CVE-2024-8927 cgi.force_redirect accepted HTTP_REDIRECT_STATUS, which a client sets with a Redirect-Status: request header, so a request straight to php-cgi passed the check; in some configurations this allows arbitrary file inclusion. - (High)
  • CVE-2024-11236 On 32-bit systems the quoted length of a very long string overflowed in the dblib and Firebird quoters, so PDO::quote() wrote past its buffer. - (Critical)
  • CVE-2024-11234 With an HTTP proxy in the stream context and request_fulluri, a request URI containing CR/LF from user input could add headers or whole requests sent through the proxy (request smuggling, requests to resources the proxy can reach). - (Medium)
  • CVE-2024-8932 On 32-bit systems the length of the escaped string could overflow for an input of about 1.4 GB, so ldap_escape() wrote past its buffer. - (Critical)
  • CVE-2024-11233 A chunk ending in =\r made the convert.quoted-printable-decode filter read one byte past its input buffer, which can crash or disclose a byte of memory. - (Medium)
  • GHSA-4w77-75f9-2c8w Heap use-after-free: in the CLI built-in web server, a request without Content-Type kept the previous request's content type pointer, freed with that request, and sapi_read_post_data() read it. - (Low)
  • CVE-2024-8929 mysqlnd trusted lengths in packets from the MySQL server: a malicious server could make the client read past a packet (the OK packet, the result set header, field metadata, LOCAL INFILE and authentication plugin messages, binary and text rows) and return the heap bytes it read to the script. - (Medium)
  • CVE-2025-14178 array_merge() summed the sizes of its arguments in 32 bits and sized the result array from the sum, so a very large merge overflowed the allocation and wrote past the end of the heap block. - (Medium)
  • CVE-2026-6722 The SOAP apache:Map decoder stored values in its reference map (SOAP_GLOBAL(ref_map)) without holding a reference to them, so a later lookup in the same message used a value freed in between (use-after-free). - (Critical)
  • CVE-2026-7261 SoapServer::handle() freed the session-persisted server object when a SOAP header raised a fault or an exception with SOAP_PERSISTENCE_SESSION on, while the session still held it, and a later request used the freed object (use-after-free). - (Medium)
  • CVE-2026-7262 The SOAP apache:Map decoder checked the wrong node for NULL, so a map item with a missing <value> element dereferenced a NULL pointer and crashed the process. - (Low)
  • CVE-2026-7568 metaphone() indexed its input with a signed int offset while the string length is a size_t, so a very long string overflowed the signed integer and read out of bounds. - (Medium)
  • CVE-2026-6735 The full PHP-FPM status page (?full&html, ?full&xml) printed each worker's request URI unescaped in its HTML and XML output, and escaped the query string without quote flags, so a crafted request gave cross-site scripting against whoever opens the status page. - (High)
  • CVE-2026-14355 openssl_encrypt() sized its output buffer for a block cipher, too small for the AES key wrap with padding modes (AES-*-WRAP-PAD), so a call wrote past the end of the heap block. - (Medium)
  • CVE-2026-9672 The GIF LZW decoder of the bundled libgd (LWZReadByte_(), ReadImage()) read uninitialised stack memory and went out of bounds on a crafted GIF with a repeated clear code.
  • CVE-2026-17543 pg_convert(), and through it pg_insert(), pg_update(), pg_select() and pg_delete(), quoted escaped strings as E'...'; with standard_conforming_strings on (PostgreSQL's default) PQescapeStringConn() leaves backslashes alone, so a value such as x\' OR 1=1 -- closed the literal (SQL injection through values a script believes are escaped). - (High)
  • CVE-2026-7260 phar_get_link_source() followed the symbolic links of a tar archive recursively without a bound, so a phar with circular symlinks overflowed the stack and crashed the process. - (Medium)
  • CVE-2026-91765 The SOAP XML parsing and decoding code (cleanup_xml_node(), master_to_zval_int()) recursed with the nesting depth of the document, or of its href references, so a deeply nested message overflowed the stack and crashed the process. - (High)
  • CVE-2025-14181 get_http_body() of SoapClient kept the body size of a chunked HTTP response in an int and checked the sum of two chunk sizes for overflow with signed arithmetic, which the compiler may remove: a malicious SOAP server could make the client reallocate a buffer too small for the data it then read into it (heap buffer overflow). - (Medium)
  • CVE-2025-1217 The HTTP stream wrapper (fopen(), file_get_contents() on http://) mis-parsed a response header folded onto a continuation line, so a malicious server could make the client take part of a header as another. - (Medium)
  • CVE-2025-1734 The HTTP stream wrapper accepted response header lines without a colon (and lines with other malformed shapes) as headers, so a malicious server could smuggle a header past the wrapper's checks. - (Medium)
  • CVE-2025-1736 check_has_header() decided whether the header stream context option already holds a standard header (Authorization, Host, User-Agent...) and accepted a match that followed a bare LF, although requests separate headers with CRLF. - (Medium)
  • CVE-2025-1861 The HTTP stream wrapper kept a redirect's Location header in a buffer of 1024 bytes and truncated a longer one, so a malicious server could make the client follow a different URL than the one it sent. - (Medium)
  • CVE-2026-93682 The HTTP stream wrapper read before the start of a redirect's Location header value when that value was empty, an over-read of the response buffer. - (Medium)
  • CVE-2026-91766 The HTTP stream wrapper kept the Authorization header (and credentials in the URL, a cookie) when it followed a redirect to another origin, handing them to a server the script never meant to trust. - (Medium)
  • CVE-2025-1220 fsockopen(), stream_socket_client() and the stream transports took the part of a host name before a NUL byte as the host and the rest as ignored, so a name such as localhost\0.example.com connected to localhost after a check against the longer name. - (Low)
  • GHSA-www2-q4fc-65wf gethostbyname(), gethostbynamel(), gethostbyaddr(), dns_get_record(), checkdnsrr(), getmxrr(), getservbyname(), getprotobyname(), inet_pton() and ip2long() took the part of their argument before a NUL byte, so a name with a NUL byte resolved as a shorter one.
  • CVE-2025-6491 SOAP gave libxml2 an over-long XML name for a SoapVar or SoapParam node (a very large namespace prefix or element name); libxml2 then did not set the node's name and the encoder compared a NULL name with strcmp() in serialize_zval() (a SoapClient serialising the SoapVar), a NULL pointer dereference; the server-side serialize_response_call2() has the same comparison. - (Medium)
  • GHSA-wg4p-4hqh-c3g9 With XML_OPTION_SKIP_TAGSTART set, xml_parse_into_struct() passed tag_name + skip to the info table before checking that the tag name was longer than the skip, an out-of-bounds read of the tag name.
  • CVE-2025-1218 More packet over-reads in the mysqlnd wire protocol, in the fields read from the greeting, OK, EOF, authentication switch, change-user, result set header and prepared statement packets. - (Low)
  • CVE-2025-1735 pg_escape_string(), pg_insert(), pg_update(), pg_convert() and the PDO_PgSQL quoter ignored the error PQescapeStringConn reports (for example for bytes invalid in the connection's encoding) and used the half-escaped string in a query, which can leave a value or name improperly escaped. - (Medium)
  • CVE-2017-9120 mysqli_real_escape_string() allocated 2 * length bytes without checking the multiplication, which wraps for a string of more than 2 GiB on a 32-bit build and then wrote past the allocation.
  • CVE-2026-6103 phar_parse_tarfile() read a tar entry's octal size into 32 bits without checking it, and skipped the data blocks of regular files only, so an oversized size or the data of another entry type was then parsed as further tar headers: a crafted archive could make PHP see entries that other tools do not (archive entry injection, e.g. past a scanner). - (Medium)
  • CVE-2026-91767 php_openssl_matches_wildcard_name() checked only the suffix's length, so a certificate wildcard name whose literal parts together were longer than the peer name made the length passed to memchr() wrap and read far past the name (heap out-of-bounds read). - (Medium)
  • CVE-2026-91769 Peer verification fell back to the certificate's Common Name whenever no subjectAltName matched, so a certificate whose SAN names another host but whose CN holds the expected name was accepted (RFC 6125 forbids the fallback once a DNS, SRV or URI identity is present). - (Medium)
  • CVE-2026-91768 The FastCGI client check compared IPv6 addresses on 12 of 16 bytes, so an allowed address matched a whole /96 prefix and other hosts in it could talk FastCGI to the pool (run scripts with arbitrary parameters). - (Medium)
  • GHSA-ch8v-r6jh-4vvr php_filter_encode_url() initialised 255 of the 256 entries of its "must encode" table, so whether byte 0xFF was percent-encoded by FILTER_SANITIZE_ENCODED depended on stack contents. - (Low)
  • CVE-2026-92842 The convert.base64-encode and convert.quoted-printable-* filters copied a line-break-chars option with pestrdup(), which stops at a NUL, but kept its full length, so the filter read past its copy and put heap bytes into its output (information disclosure). - (Medium)
  • CVE-2026-7258 Many functions (urldecode() among them) passed a signed char to the ctype.h functions; for bytes >= 0x80 the argument was negative, and C libraries whose tables do not cover negative values read out of bounds. - (Medium)
  • CVE-2017-9118 preg_replace() and preg_replace_callback() grew their result with an overflow-checked size to which zend_string_alloc() then added the string header, so a result length just under SIZE_MAX wrapped and the copy that followed wrote past the buffer.
  • GHSA-m3wq-j48p-jxwh The bundled libzip indexes entry names with a fixed hash, so an archive can put every entry name into one bucket and make each lookup walk the whole chain (hash flooding, GHSA-m3wq-j48p-jxwh, fixed in libzip 1.12). - (Low)
  • CVE-2021-40812 The bundled libgd's BMP and WebP writers ignored the result of gdPutBuf(), so a short write was not reported, and the BMP writer's error path freed the caller's context instead of its own temporary one. - (Medium)
  • CVE-2019-20454 The bundled PCRE2 10.32 misses fixes of later releases: CVE-2019-20454 (out-of-bounds read when the JIT matches \X, fixed in 10.34), CVE-2022-1586 and CVE-2022-1587 (JIT out-of-bounds reads in the matching of Unicode property classes and in recursion, fixed in 10.40) and CVE-2026-89156 (the JIT-to-interpreter fallback runs on a subject whose UTF validity was not checked). - (Medium)
  • CVE-2026-103111 A PCRE2 JIT stack allocation larger than the growth step wrote below the stack (CVE-2026-103111, advisory GHSA-r9hj-j2rw-4q3m, fixed in 10.49). ext/pcre creates a growable JIT stack, so the code is reachable. - (High)
  • GHSA-43gg-c3xx-7w7g The AArch64 NEON scanning of JIT-compiled matching read 16 bytes past the end of the subject (out-of-bounds read, denial of service; a standalone PCRE2 advisory with no CVE, fixed in 10.47). - (Low)
  • CVE-2019-16168 The bundled SQLite 3.28.0 (April 2019) misses the fixes of every release since, among them the 42 advisories listed for this entry (memory corruption and denial of service in the parser, the query planner, window functions, FTS3 and FTS5, virtual tables and the CLI shell); upgraded to the 3.54.1 amalgamation. - (Medium)
  • CVE-2024-2408 The Marvin attack: RSA decryption with PKCS#1 v1.5 padding (OPENSSL_PKCS1_PADDING, the default) leaks through timing whether the padding was valid, so an attacker who can submit many ciphertexts and time the answers can decrypt a ciphertext or forge a signature. - (Medium)

Upgrade notes

  • This is the first release of NES for PHP 7.3, for Amazon Linux 2023 (x86_64 and aarch64). There are no container images and no Windows zip for PHP 7.3.
  • php -v and PHP_VERSION report 7.3.33-nes, so version_compare(PHP_VERSION, '7.3.33', '>=') is false. PHP_VERSION_ID stays 70333, and extensions built for PHP 7.3 load as before.
  • The packages carry Amazon Linux 2023's own naming for a PHP version: php7.3, php7.3-cli, php7.3-fpm, php7.3-mysqlnd and the rest. Each one also provides the plain php-* name, so packages that require php-cli or php-mysqlnd are satisfied. Only one PHP version can be installed at a time: to move a host from Amazon Linux 2023's php8.x packages, install the php7.3-* packages with --allowerasing (see Installation), which replaces PHP 8.
  • The packages build the extensions that Amazon Linux 2023's own PHP packages build. imap, interbase/pdo_firebird, pdo_dblib and recode are not built, because Amazon Linux 2023 does not ship the libraries they need. Argon2 password hashing (PASSWORD_ARGON2I, PASSWORD_ARGON2ID) is available.
  • php7.3-pecl-zip is PHP's zip extension linked against Amazon Linux 2023's libzip. php7.3-pecl-apcu is APCu 5.1.28. php7.3-pear is PEAR 1.10.18; with php7.3-devel (and a compiler), pecl install works.
  • PHP's bundled PCRE2, Oniguruma (mbstring) and libgd are part of the packages, so fixes to them come with NES for PHP releases. SQLite, libzip, libxml2, OpenSSL and the other system libraries are Amazon Linux 2023's, and their fixes come with the operating system's updates.
  • A script that runs out of memory_limit now ends its process: the fatal error goes to stderr (and to error_log when log_errors is on; with php-fpm, to the pool's error log), and no shutdown function runs. php-fpm starts a new worker in its place. Raise memory_limit where a script needs more. This is the mitigation of CVE-2026-109618 and CVE-2026-109619.
  • Session upload progress is off: the shipped php.ini sets session.upload_progress.enabled = Off, its compiled default is Off, and setting it to On has no effect. This mitigates CVE-2026-115560, which needs session upload progress and has no upstream fix yet; the fix will follow in a later release.
  • Multipart form uploads are limited to max_multipart_body_parts parts (the fix for CVE-2023-0662). Its default, -1, means max_input_vars plus max_file_uploads; the parts after the limit are not processed, and a warning is logged. Set max_multipart_body_parts in php.ini if your forms need more.
  • On 64-bit builds an array cannot have 2^30 (1,073,741,824) or more slots; asking for one is a fatal error.
  • yield from a generator that was aborted, for example one that threw an exception, now throws an Error ("Generator passed to yield from was aborted without proper return and is unable to continue"), as PHP 8.0 does; before, the expression evaluated to null. This comes with the fix for a use-after-free in generators that are delegated to by more than one yield from.
  • Extensions built outside these packages that use the engine's generator internals (generator-aware profilers, tracers and debuggers) must be rebuilt with this release's php7.3-devel: built against other PHP 7.3 headers, they can return the wrong generator or crash. The extensions in these packages, APCu included, are already built against it.
  • TLS peer verification no longer falls back to the certificate's Common Name when the certificate has a DNS, URI or SRV subjectAltName that does not match the peer name (the fix for CVE-2026-91769). The warning then reads "Peer certificate subjectAltName did not match expected name".
  • After a redirect to another origin, the HTTP stream wrapper no longer sends the Authorization and Cookie headers of a stream context's header option, nor its Proxy-Authorization header when no proxy is used (the fix for CVE-2026-91766).