\n<\/p>\n
PHP maintainers have launched safety updates to handle three vulnerabilities affecting the PostgreSQL, BCMath, and Phar extensions. These vulnerabilities might doubtlessly result in SQL injection assaults<\/a>, out-of-bounds reminiscence writes, and denial-of-service assaults in weak purposes. <\/p>\n The problems affect a number of actively maintained PHP launch branches and have been resolved in variations PHP 8.2.338.2, 8.3.338.3, 8.4.248.4, and eight.5.98.5, relying on the affected extension. <\/p>\n Organizations working PHP purposes ought to prioritize upgrading, particularly if their purposes course of untrusted database enter, carry out BCMath operations on user-controlled values, or deal with Phar archives.<\/p>\n Probably the most essential situation, tracked as CVE-2026-17543<\/a> and GHSA-7qpv-r5mr-78m4, is a high-severity SQL injection vulnerability in PHP\u2019s PostgreSQL extension (ext-pgsql). <\/p>\n This flaw is discovered within the operate php_pgsql_convert(), which is utilized by comfort features similar to pg_insert(), pg_update(), pg_select(), and pg_delete() to transform and escape user-supplied parameters. <\/p>\n Earlier than the replace, this operate utilized PostgreSQL\u2019s PQescapeStringConn() operate. It wrapped the ensuing values in an escape string fixed formatted as E\u2019\u2026\u2019. <\/p>\n This strategy turns into unsafe when PostgreSQL makes use of the standard_conforming_strings setting, which has been enabled by default since PostgreSQL model 9.19.<\/p>\n With this configuration, PQescapeStringConn() fails to flee backslash characters appropriately for values that will likely be embedded inside an E\u2019\u2026\u2019 string. <\/p>\n An attacker who can affect a parameter handed to one among these helper features might insert a backslash adopted by a quote, breaking out of the meant SQL string context. <\/p>\n The remaining enter could then be handled as legitimate SQL syntax, permitting the attacker to change question logic, doubtlessly entry unauthorized data, or manipulate database content material, relying on the applying\u2019s privileges. <\/p>\n PHP\u2019s repair alters the parameter dealing with logic to make use of non-escaping string constants as an alternative of wrapping escaped values in E\u2019\u2026\u2019. This vulnerability was reported by ExPatch-LLC, with evaluation and remediation supported by PHP contributors.<\/p>\n A second high-severity vulnerability, CVE-2026-17544<\/a> (GHSA-x692-q9x7-8c3f), impacts the BCMath extension in PHP variations 8.48 and eight.58. <\/p>\n This situation can result in an out-of-bounds write when an software calls the bccomp() operate with attacker-controlled numeric operands and a maliciously crafted scale worth. <\/p>\n The error happens within the bc_str2num() operate when a manually specified scale truncates decimal digits, and subsequent logic removes trailing zeroes. <\/p>\n Whereas the code reduces the calculated scale and allocates a smaller numeric buffer, it beforehand retained the unique pointer to the fractional finish through the copy operation.<\/p>\n In consequence, PHP might find yourself copying extra knowledge than the newly allotted buffer can accommodate, doubtlessly corrupting stack or heap reminiscence. <\/p>\n BCMath initially makes use of a small stack-based reminiscence space<\/a> earlier than switching to heap allocation, that means the affect could differ based mostly on the enter and execution atmosphere. <\/p>\n Reminiscence corruption vulnerabilities can result in software crashes and, in sure circumstances, could present attackers with a path for extra extreme exploitation. <\/p>\n The patch corrects the pointer dealing with after zero truncation, guaranteeing that copied knowledge aligns with the decreased allocation measurement. Safety researcher Recep Asan reported this flaw.<\/p>\nPHP Patches 3 Safety Flaws<\/strong><\/h2>\n