Ubuntu Linux - PHP: Failure to setup TLS with a remote server can result in a remote DoS

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3164-1 advisory.

    This update for php8 fixes the following issues

    - Update to version 8.3.32
    - CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS (bsc#1270712).
    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    PHP: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD     (CVE-2026-14355)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22635-1 advisory.

    This update for php8 fixes the following issues

    - Update to versio 8.4.23
    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21308-1 advisory.

    This update for php8 fixes the following issues

    - Update to versio 8.4.23
    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.32, 8.3.x prior to 8.3.32, 8.4.x to 8.4.23 or 8.5.x prior to 8.5.8. It is, therefore, affected by multiple vulnerabilities:

- A heap buffer overflow vulnerability exists in the OpenSSL extension due to incorrect buffer allocation in openssl_encrypt() when using the AES-WRAP-PAD cipher, causing OpenSSL to write past allocated heap memory and leading to heap corruption or application crash. (CVE-2026-14355)

- A segfault vulnerability exists in the Streams extension in file_get_contents() when fetching an HTTPS URL with a proxy configured. (CVE-2026-12184)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ubuntu Linux - PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-12184


The version of PHP installed on the remote host is prior to 8.3.32. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.32 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1733 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

    In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
    (CVE-2026-44927)

    In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1726 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
328913	SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3164-1)	Nessus	SuSE Local Security Checks	Local	medium
328509	Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)	Nessus	Amazon Linux Local Security Checks	Local	medium
327568	SUSE SLES16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:22635-1)	Nessus	SuSE Local Security Checks	Local	medium
326674	openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21308-1)	Nessus	SuSE Local Security Checks	Local	medium
115291	PHP 8.5.x < 8.5.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115288	PHP 8.4.x < 8.4.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115287	PHP 8.3.x < 8.3.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115286	PHP 8.2.x < 8.2.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
325069	Linux Distros Unpatched Vulnerability : CVE-2026-12184	Nessus	Misc.	Local	high
444413	Alpine: multiple php83 packages: security update to 8.3.32-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
444413	Alpine: multiple php83 packages: security update to 8.3.32-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
324980	PHP 8.3.x < 8.3.32 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium
316984	Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1733)	Nessus	Amazon Linux Local Security Checks	Local	critical
316837	Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-1726)	Nessus	Amazon Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-12184

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

high

critical

critical

medium

critical

critical