CVE-2026-14355: debian debian_linux Heap-based Buffer Overflow

CVSS: 5.6v3.1MediumAnalyzed

AliasesMGASA-2026-0274MGASA-2026-0285SUSE-SU-2026:3165-1+9 more

Published 03-07-2026Last modified 06-07-2026

Vulnerability summary

CVE-2026-14355 is a medium (CVSS 5.6) Heap-based Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.6/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.28%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 6

OPENSUSE-SU-2026:11269-1 OPENSUSE-SU-2026:21308-1 RHSA-2026:61259 SUSE-SU-2026:22635-1 SUSE-SU-2026:3164-1 SUSE-SU-2026:3514-1+1 more

Timeline

03-07-2026
PublishedVulnerability first disclosed.
06-07-2026
Last modifiedVulnerability information updated.

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

CVSS metrics

5 scores · 5 sources · 1 version

v3.15.6

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

0.00 pp

From 0.28% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected systems

Redhat135 products

apcu-panel< 0:5.1.23-1.module+el9.7.0+24111+199d2cc4 | < 0:5.1.23-1.module+el8.10.0+20770+a5eca186 | < 0:5.1.18-1.module+el8.10.0+22485+a3539972 | < 0:5.1.23-1.module+el9.8.0+24343+756b4fcd
libzip< 0:1.7.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.6.1-1.module+el8.10.0+22485+a3539972
libzip-debuginfo< 0:1.7.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.6.1-1.module+el8.10.0+22485+a3539972
libzip-debugsource< 0:1.7.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.6.1-1.module+el8.10.0+22485+a3539972
libzip-devel< 0:1.7.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.6.1-1.module+el8.10.0+22485+a3539972

libzip-tools< 0:1.7.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.6.1-1.module+el8.10.0+22485+a3539972
libzip-tools-debuginfo< 0:1.7.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.6.1-1.module+el8.10.0+22485+a3539972
php< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-bcmath< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-bcmath-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-cli< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-cli-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-common< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-common-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-dba< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-dba-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-dbg< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-dbg-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-debugsource< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-devel< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-embedded< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-embedded-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-enchant< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-enchant-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-ffi< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-ffi-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-fpm< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-fpm-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-gd< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-gd-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-gmp< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-gmp-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-intl< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-intl-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-json< 0:7.4.33-5.module+el8.10.0+24515+65267a7f
php-json-debuginfo< 0:7.4.33-5.module+el8.10.0+24515+65267a7f
php-ldap< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-ldap-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-mbstring< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-mbstring-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-mysqlnd< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-mysqlnd-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-odbc< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-odbc-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-opcache< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-opcache-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-pdo< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-pdo-dblib< 0:8.5.8-2.hum1
php-pdo-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-pdo-firebird< 0:8.5.8-2.hum1
php-pear< 1:1.10.14-1.module+el8.10.0+20770+a5eca186 | < 1:1.10.13-1.module+el8.10.0+22485+a3539972
php-pecl-apcu< 0:5.1.23-1.module+el9.7.0+24111+199d2cc4 | < 0:5.1.23-1.module+el8.10.0+20770+a5eca186 | < 0:5.1.18-1.module+el8.10.0+22485+a3539972 | < 0:5.1.23-1.module+el9.8.0+24343+756b4fcd
php-pecl-apcu-debuginfo< 0:5.1.23-1.module+el9.7.0+24111+199d2cc4 | < 0:5.1.23-1.module+el8.10.0+20770+a5eca186 | < 0:5.1.18-1.module+el8.10.0+22485+a3539972 | < 0:5.1.23-1.module+el9.8.0+24343+756b4fcd
php-pecl-apcu-debugsource< 0:5.1.23-1.module+el9.7.0+24111+199d2cc4 | < 0:5.1.23-1.module+el8.10.0+20770+a5eca186 | < 0:5.1.18-1.module+el8.10.0+22485+a3539972 | < 0:5.1.23-1.module+el9.8.0+24343+756b4fcd
php-pecl-apcu-devel< 0:5.1.23-1.module+el9.7.0+24111+199d2cc4 | < 0:5.1.23-1.module+el8.10.0+20770+a5eca186 | < 0:5.1.18-1.module+el8.10.0+22485+a3539972 | < 0:5.1.23-1.module+el9.8.0+24343+756b4fcd
php-pecl-redis6< 0:6.1.0-3.module+el9.8.0+24343+756b4fcd
php-pecl-redis6-debuginfo< 0:6.1.0-3.module+el9.8.0+24343+756b4fcd
php-pecl-redis6-debugsource< 0:6.1.0-3.module+el9.8.0+24343+756b4fcd
php-pecl-rrd< 0:2.0.3-4.module+el9.7.0+24111+199d2cc4 | < 0:2.0.3-1.module+el8.10.0+20770+a5eca186 | < 0:2.0.1-1.module+el8.10.0+22485+a3539972 | < 0:2.0.3-4.module+el9.8.0+24343+756b4fcd
php-pecl-rrd-debuginfo< 0:2.0.3-4.module+el9.7.0+24111+199d2cc4 | < 0:2.0.3-1.module+el8.10.0+20770+a5eca186 | < 0:2.0.1-1.module+el8.10.0+22485+a3539972 | < 0:2.0.3-4.module+el9.8.0+24343+756b4fcd
php-pecl-rrd-debugsource< 0:2.0.3-4.module+el9.7.0+24111+199d2cc4 | < 0:2.0.3-1.module+el8.10.0+20770+a5eca186 | < 0:2.0.1-1.module+el8.10.0+22485+a3539972 | < 0:2.0.3-4.module+el9.8.0+24343+756b4fcd
php-pecl-xdebug< 0:2.9.5-1.module+el8.10.0+22485+a3539972
php-pecl-xdebug-debuginfo< 0:2.9.5-1.module+el8.10.0+22485+a3539972
php-pecl-xdebug-debugsource< 0:2.9.5-1.module+el8.10.0+22485+a3539972
php-pecl-xdebug3< 0:3.2.2-2.module+el9.7.0+24111+199d2cc4 | < 0:3.2.2-2.module+el8.10.0+20798+00eaeb41 | < 0:3.3.1-1.module+el9.8.0+24343+756b4fcd
php-pecl-xdebug3-debuginfo< 0:3.2.2-2.module+el9.7.0+24111+199d2cc4 | < 0:3.2.2-2.module+el8.10.0+20798+00eaeb41 | < 0:3.3.1-1.module+el9.8.0+24343+756b4fcd
php-pecl-xdebug3-debugsource< 0:3.2.2-2.module+el9.7.0+24111+199d2cc4 | < 0:3.2.2-2.module+el8.10.0+20798+00eaeb41 | < 0:3.3.1-1.module+el9.8.0+24343+756b4fcd
php-pecl-zip< 0:1.22.3-1.module+el9.7.0+24111+199d2cc4 | < 0:1.22.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.18.2-1.module+el8.10.0+22485+a3539972 | < 0:1.22.3-1.module+el9.8.0+24343+756b4fcd
php-pecl-zip-debuginfo< 0:1.22.3-1.module+el9.7.0+24111+199d2cc4 | < 0:1.22.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.18.2-1.module+el8.10.0+22485+a3539972 | < 0:1.22.3-1.module+el9.8.0+24343+756b4fcd
php-pecl-zip-debugsource< 0:1.22.3-1.module+el9.7.0+24111+199d2cc4 | < 0:1.22.3-1.module+el8.10.0+20770+a5eca186 | < 0:1.18.2-1.module+el8.10.0+22485+a3539972 | < 0:1.22.3-1.module+el9.8.0+24343+756b4fcd
php-pgsql< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-pgsql-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-process< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-process-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-snmp< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-snmp-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-soap< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-soap-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-sodium< 0:8.5.8-2.hum1
php-tidy< 0:8.5.8-2.hum1
php-xml< 0:8.5.8-2.hum1 | < 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-xml-debuginfo< 0:8.2.32-1.module+el9.8.0+24509+ccb2f649 | < 0:8.2.32-1.module+el8.10.0+24514+5bfab8b6 | < 0:7.4.33-5.module+el8.10.0+24515+65267a7f | < 0:8.3.32-1.el10_2 | < 0:8.3.32-1.module+el9.8.0+24508+6fcf2e7a
php-xmlrpc< 0:7.4.33-5.module+el8.10.0+24515+65267a7f
php-xmlrpc-debuginfo< 0:7.4.33-5.module+el8.10.0+24515+65267a7f
php8.4< 0:8.4.23-1.el10_2
php8.4-bcmath< 0:8.4.23-1.el10_2
php8.4-bcmath-debuginfo< 0:8.4.23-1.el10_2
php8.4-cli< 0:8.4.23-1.el10_2
php8.4-cli-debuginfo< 0:8.4.23-1.el10_2
php8.4-common< 0:8.4.23-1.el10_2
php8.4-common-debuginfo< 0:8.4.23-1.el10_2
php8.4-dba< 0:8.4.23-1.el10_2
php8.4-dba-debuginfo< 0:8.4.23-1.el10_2
php8.4-dbg< 0:8.4.23-1.el10_2
php8.4-dbg-debuginfo< 0:8.4.23-1.el10_2
php8.4-debuginfo< 0:8.4.23-1.el10_2
php8.4-debugsource< 0:8.4.23-1.el10_2
php8.4-devel< 0:8.4.23-1.el10_2
php8.4-embedded< 0:8.4.23-1.el10_2
php8.4-embedded-debuginfo< 0:8.4.23-1.el10_2
php8.4-enchant< 0:8.4.23-1.el10_2
php8.4-enchant-debuginfo< 0:8.4.23-1.el10_2
php8.4-ffi< 0:8.4.23-1.el10_2
php8.4-ffi-debuginfo< 0:8.4.23-1.el10_2
php8.4-fpm< 0:8.4.23-1.el10_2
php8.4-fpm-debuginfo< 0:8.4.23-1.el10_2
php8.4-gd< 0:8.4.23-1.el10_2
php8.4-gd-debuginfo< 0:8.4.23-1.el10_2
php8.4-gmp< 0:8.4.23-1.el10_2
php8.4-gmp-debuginfo< 0:8.4.23-1.el10_2
php8.4-intl< 0:8.4.23-1.el10_2
php8.4-intl-debuginfo< 0:8.4.23-1.el10_2
php8.4-ldap< 0:8.4.23-1.el10_2
php8.4-ldap-debuginfo< 0:8.4.23-1.el10_2
php8.4-mbstring< 0:8.4.23-1.el10_2
php8.4-mbstring-debuginfo< 0:8.4.23-1.el10_2
php8.4-mysqlnd< 0:8.4.23-1.el10_2
php8.4-mysqlnd-debuginfo< 0:8.4.23-1.el10_2
php8.4-odbc< 0:8.4.23-1.el10_2
php8.4-odbc-debuginfo< 0:8.4.23-1.el10_2
php8.4-opcache< 0:8.4.23-1.el10_2
php8.4-opcache-debuginfo< 0:8.4.23-1.el10_2
php8.4-pdo< 0:8.4.23-1.el10_2
php8.4-pdo-debuginfo< 0:8.4.23-1.el10_2
php8.4-pgsql< 0:8.4.23-1.el10_2
php8.4-pgsql-debuginfo< 0:8.4.23-1.el10_2
php8.4-process< 0:8.4.23-1.el10_2
php8.4-process-debuginfo< 0:8.4.23-1.el10_2
php8.4-snmp< 0:8.4.23-1.el10_2
php8.4-snmp-debuginfo< 0:8.4.23-1.el10_2
php8.4-soap< 0:8.4.23-1.el10_2
php8.4-soap-debuginfo< 0:8.4.23-1.el10_2
php8.4-xml< 0:8.4.23-1.el10_2
php8.4-xml-debuginfo< 0:8.4.23-1.el10_2

Show all 135

Suse8 products

apache2-mod_php7&distro=SUSE Linux Enterprise Module for Legacy 15 SP7< 7.4.33-150400.4.63.1
apache2-mod_php7&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 7.4.33-150400.4.63.1
php7-embed&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 7.4.33-150400.4.63.1
php7-fastcgi&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 7.4.33-150400.4.63.1
php7-fpm&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 7.4.33-150400.4.63.1

Show all 8

Ubuntu7 products

php5All versions (No fix recorded)
php7.2All versions (No fix recorded)
php7.4All versions (No fix recorded)
php8.1< 8.1.2-1ubuntu2.25
php8.3< 8.3.6-0ubuntu0.24.04.10

Show all 7

Debian3 products

php8.2< 8.2.32-1~deb12u1
php8.4< 8.4.23-1~deb13u1 | < 8.4.23-1
debian_linux12.0

Mageia3 products

php8.4< 8.4.23-1.mga10
php8.5< 8.5.8-1.mga10
php< 8.2.32-1.mga9

Php1 product

php≥ 8.2.0, < 8.2.32 | ≥ 8.3.0, < 8.3.32 | ≥ 8.4.0, < 8.4.23 | ≥ 8.5.0, < 8.5.8

6 vendors · 157 products

References

42 links

github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vrVendor AdvisoryARTICLEREPORT
lists.debian.org/debian-lts-announce/2026/07/msg00010.htmlMailing ListThird Party Advisory
advisories.mageia.org/MGASA-2026-0274.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=35807REPORT
www.php.net/ChangeLog-8.phpWEB
advisories.mageia.org/MGASA-2026-0285.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=35809REPORT
www.php.net/ChangeLog-8.phpWEB
www.php.net/ChangeLog-8.phpWEB
www.suse.com/support/update/announcement/2026/suse-su-20263165-1/Advisory

Show all 42 references

bugzilla.suse.com/1270351REPORT
www.suse.com/security/cve/CVE-2026-14355WEB
access.redhat.com/errata/RHSA-2026:34164Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-14355REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34164.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2496971REPORT
www.cve.org/CVERecord?id=CVE-2026-14355AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-14355AdvisoryOval
access.redhat.com/errata/RHSA-2026:40416Advisory
access.redhat.com/security/updates/classification/ARTICLE
issues.redhat.com/browse/RHEL-192622ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40416.jsonAdvisory
access.redhat.com/errata/RHSA-2026:47749Advisory
issues.redhat.com/browse/RHEL-192626ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47749.jsonAdvisory
access.redhat.com/errata/RHSA-2026:47750Advisory
issues.redhat.com/browse/RHEL-192629ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47750.jsonAdvisory
access.redhat.com/errata/RHSA-2026:48170Advisory
issues.redhat.com/browse/RHEL-192618ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48170.jsonAdvisory
access.redhat.com/errata/RHSA-2026:48197Advisory
issues.redhat.com/browse/RHEL-192620ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48197.jsonAdvisory
access.redhat.com/errata/RHSA-2026:49914Advisory
issues.redhat.com/browse/RHEL-192616ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49914.jsonAdvisory
ubuntu.com/security/CVE-2026-14355REPORT
ubuntu.com/security/notices/USN-8564-1Advisory
security-tracker.debian.org/tracker/CVE-2026-14355Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities