CVE-2024-9026: PHP-FPM logs from children may be altered
Vulnerability summary
CVE-2024-9026 is a low (CVSS 3.3) Improper Output Neutralization for Logs vulnerability in php group php. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 3.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 8Timeline
- 08-10-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · AlpineEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.49% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPhp Src
Maturity: poc
Weaknesses
CWE · root cause- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
- CWE-158Improper Neutralization of Null Byte or NUL CharacterThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine3 products
- php81< 8.1.30-r0
- php82< 8.2.24-r0
- php83< 8.3.12-r0
Ubuntu2 products
- php8.1< 8.1.2-1ubuntu2.19
- php8.3< 8.3.6-0ubuntu0.24.04.2
Chainguard1 product
- php-8.1< 8.1.30-r0
Debian1 product
- php8.2< 8.2.24-1~deb12u1
Php1 product
- php≥ 8.1.0, < 8.1.30 | ≥ 8.2.0, < 8.2.24 | ≥ 8.3.0, < 8.3.12
Php group1 product
- php≥ 8.1.*, < 8.1.30 | ≥ 8.2.*, < 8.2.24 | ≥ 8.3.*, < 8.3.12
Wolfi1 product
- php-8.1< 8.1.30-r0
7 vendors · 10 products
