Detections
Analytics

Echo: php-8.1: security update to 8.1.34+e1

medium Tenable Cloud Security Plugin ID 476629

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream
 filters accept a line-break-chars option whose length is tracked separately from the string itself. The
 filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping
 the original length. When the filter later emits a line break it copies the recorded length out of the
 truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
 (CVE-2026-92842)

Solution

Update the php-8.1 library and its related packages to version 8.1.34+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-92842

Plugin Details

Severity: Medium

ID: 476629

Version: Revision 1.1

Type: Local

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-92842

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 9/22/2026

Reference Information

CVE: CVE-2026-92842