PHP Security Update Fixes Remote DoS and OpenSSL Memory Corruption Flaws

PHP maintainers have released patches addressing two vulnerabilities: a high-severity remote denial-of-service (DoS) flaw affecting TLS stream handling, and a moderate-severity heap corruption bug in the OpenSSL extension.

Both issues were disclosed via GitHub Security Advisories four days ago and carry fixes across multiple supported PHP branches.

PHP Security Update

The more severe of the two flaws, tracked as CVE-2026-12184 and rated High (CVSS 4.0: 8.7), resides in php_stream_url_wrap_http_ex.

When TLS crypto setup fails triggered via php_stream_xport_crypto_setup or php_stream_xport_crypto_enable the underlying stream is closed and reset to NULL.

However, a subsequent peer-name cleanup block unconditionally attempts to reset the peer name on that now-null stream.

Researcher ndossche demonstrated that this condition is reachable without crafted exploit code; simply connecting to a remote server presenting an invalid or expired certificate is enough to trigger it.

Because the bug lives in PHP’s HTTP stream wrapper, any application that performs outbound HTTPS requests and has certificate validation fail can crash the entire PHP-FPM process, taking down all worker threads simultaneously.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) reflects no confidentiality or integrity impact but high availability impact, requiring no privileges or user interaction, only network access and specific attack conditions (a failing TLS handshake).

Patched versions: 8.3.32, 8.4.21, 8.5.6 (affects versions below these).

The second flaw, CVE-2026-14355, rated Moderate (CVSS 3.1: 4.7), affects openssl_encrypt() when using the AES-WRAP-PAD algorithm.

The root cause is a buffer sizing error: PHP allocates the output zend_string based solely on plaintext length, without accounting for RFC 5649 expansion rules.

Key-wrap-with-padding rounds plaintext up to the next 8-byte boundary and prepends an 8-byte Alternative Initial Value (AIV), meaning actual ciphertext length equals roundup(len, 8) + 8 not a simple function of raw input size.

Since PHP’s allocation ignores this, OpenSSL’s EVP_EncryptUpdate/EVP_EncryptFinal calls write past the end of the undersized heap buffer, corrupting adjacent Zend Memory Manager metadata.

This doesn’t crash immediately at the overflow point instead, it surfaces later as a zend_mm_heap corrupted abort when the allocator detects the tampered bookkeeping during an unrelated operation, making root-cause diagnosis harder without knowing the underlying advisory.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) indicates network-exploitable conditions with high attack complexity, since exploitation requires an application to actually use the rarely deployed AES-WRAP-PAD mode.

Patched versions: 8.2.32, 8.3.32, 8.4.23, 8.5.8.

Mitigation

Organizations running PHP in production, particularly those handling outbound HTTPS connections or using OpenSSL key-wrap operations should upgrade immediately to the patched versions listed above.

Given the FPM-crashing potential of CVE-2026-12184, this update should be prioritized for any internet-facing PHP applications making outbound TLS connections to third-party or untrusted endpoints.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.