In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3164-1 advisory.

    This update for php8 fixes the following issues

    - Update to version 8.3.32
    - CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS (bsc#1270712).
    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3165-1 advisory.

    This update for php7 fixes the following issue

    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    PHP: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD     (CVE-2026-14355)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1959 advisory.

    PHP: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD     (CVE-2026-14355)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1958 advisory.

    PHP: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD     (CVE-2026-14355)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.32-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2026-012 advisory.

    PHP: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD     (CVE-2026-14355)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1957 advisory.

    PHP: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD     (CVE-2026-14355)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40416 advisory.

    php     [8.2.32-1]
    - rebase to 8.2.32

    php-pecl-apcu     [5.1.23-1]
    - update to 5.1.23 for PHP 8.2 RHEL-14699

    php-pecl-rrd     [2.0.3-4]
    - build for PHP 8.1 #2070040

    [2.0.3-3]
    - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags       Related: rhbz#1991688

    [2.0.3-2]
    - Rebuilt for RHEL 9 BETA for openssl 3.0       Related: rhbz#1971065

    [2.0.3-1]
    - update to 2.0.3

    [2.0.2-1]
    - update to 2.0.2

    [2.0.1-17]
    - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

    [2.0.1-16]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [2.0.1-15]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

    php-pecl-xdebug3     [3.2.2-2]
    - drop inet_ntoa usage using upstream patch

    [3.2.2-1]
    - update to 3.2.2 for PHP 8.2 RHEL-14699

    php-pecl-zip     [1.22.3-1]
    - update to 1.22.3 for PHP 8.2 RHEL-14699

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22635-1 advisory.

    This update for php8 fixes the following issues

    - Update to versio 8.4.23
    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21308-1 advisory.

    This update for php8 fixes the following issues

    - Update to versio 8.4.23
    - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer     allocation flaw (bsc#1270351).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.32, 8.3.x prior to 8.3.32, 8.4.x to 8.4.23 or 8.5.x prior to 8.5.8. It is, therefore, affected by multiple vulnerabilities:

 - A heap buffer overflow vulnerability exists in the OpenSSL extension due to incorrect buffer allocation in openssl_encrypt() when using the AES-WRAP-PAD cipher, causing OpenSSL to write past allocated heap memory and leading to heap corruption or application crash. (CVE-2026-14355)

 - A segfault vulnerability exists in the Streams extension in file_get_contents() when fetching an HTTPS URL with a proxy configured. (CVE-2026-12184)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.4.23. It is, therefore, affected by a vulnerability as referenced in the Version 8.4.23 advisory.

  - In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the     AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output     buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting     for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata     and triggering application abort. (CVE-2026-14355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php82 installed on the remote host is prior to 8.2.32. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-186-02 advisory.

    New php82 packages are available for Slackware 15.0 to fix a security issue.

Tenable has extracted the preceding description block directly from the php82 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4669 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4669-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 04, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : php8.2     Version        : 8.2.32-1~deb12u1     CVE ID         : CVE-2026-14355

    It was discovered that a buffer overflow in the implementation of AES     Key Wrap with Padding in the openssl extension of PHP, a widely-used     open source general purpose scripting language, could result in memory     corruption.

    For Debian 12 bookworm, this problem has been fixed in version     8.2.32-1~deb12u1.

    We recommend that you upgrade your php8.2 packages.

    For the detailed security status of php8.2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6377 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6377-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     July 04, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.4     CVE ID         : CVE-2026-14355

    It was discovered that a buffer overflow in the implementation of AES     Key Wrap with Padding in the openssl extension of PHP, a widely-used     open source general purpose scripting language, could result in memory     corruption.

    For the stable distribution (trixie), this problem has been fixed in     version 8.4.23-1~deb13u1.

    We recommend that you upgrade your php8.4 packages.

    For the detailed security status of php8.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.4

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the     AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output     buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting     for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata     and triggering application abort. (CVE-2026-14355)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of PHP installed on the remote host is prior to 8.3.32. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.32 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.8. It is, therefore, affected by a vulnerability as referenced in the Version 8.5.8 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.32. It is, therefore, affected by a vulnerability as referenced in the Version 8.2.32 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
328913	SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3164-1)	Nessus	SuSE Local Security Checks	medium
328899	SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3165-1)	Nessus	SuSE Local Security Checks	medium
328509	Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)	Nessus	Amazon Linux Local Security Checks	medium
328475	Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-1959)	Nessus	Amazon Linux Local Security Checks	medium
328467	Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-1958)	Nessus	Amazon Linux Local Security Checks	medium
328465	Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-012 (ALASPHP8.2-2026-012)	Nessus	Amazon Linux Local Security Checks	medium
328457	Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1957)	Nessus	Amazon Linux Local Security Checks	medium
328013	Oracle Linux 9 : php:8.2 (ELSA-2026-40416)	Nessus	Oracle Linux Local Security Checks	medium
327568	SUSE SLES16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:22635-1)	Nessus	SuSE Local Security Checks	medium
326674	openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21308-1)	Nessus	SuSE Local Security Checks	medium
115291	PHP 8.5.x < 8.5.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115288	PHP 8.4.x < 8.4.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115287	PHP 8.3.x < 8.3.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115286	PHP 8.2.x < 8.2.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
325694	PHP 8.4.x < 8.4.23	Nessus	CGI abuses	medium
325218	Slackware Linux 15.0 php82 Vulnerability (SSA:2026-186-02)	Nessus	Slackware Local Security Checks	medium
325144	Debian dla-4669 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	medium
325109	Debian dsa-6377 : libapache2-mod-php8.4 - security update	Nessus	Debian Local Security Checks	medium
325000	Linux Distros Unpatched Vulnerability : CVE-2026-14355	Nessus	Misc.	medium
324980	PHP 8.3.x < 8.3.32 Multiple Vulnerabilities	Nessus	CGI abuses	medium
324979	PHP 8.5.x < 8.5.8	Nessus	CGI abuses	medium
324978	PHP 8.2.x < 8.2.32	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2026-14355

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium