MGASA-2026-0458: php Mageia
Vulnerability summary
MGASA-2026-0458 is a vulnerability in php Mageia with no CVSS score yet.
Advisory lineage
Upstream 10 · Downstream 0Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 28-09-2026Last modifiedVulnerability information updated.
Description
Updated php package fixes security vulnerabilities FILTER_SANITIZE_ENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN Integer overflow in phar_tar_number() allowing TAR archive entry injection Unbounded recursion in server-side cleanup_xml_node() Integer overflow to buffer overflow in SOAP HTTP parsing) Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL ross-origin credential leak in HTTP stream wrapper redirects Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia1 product
- php< 8.2.34-1.mga9
1 vendor · 1 product