php

3 tools · 5 release lines

PHP runtime. Each tool carries its own sandbox boundary — they are not the same.

kapsl php

kapsl php-config

kapsl phpize

Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises

latest 8.5.10 stable 2026-08-30

tracks the newest supported release 8.5 8.5.10 stable 2026-08-30

tracks the newest 8.5 release 8.4 8.4.25 stable 2026-08-30

tracks the newest 8.4 release 8.3 8.3.33 stable 2026-08-30

tracks the newest 8.3 release 8.2 8.2.33 stable 2026-08-30

tracks the newest 8.2 release

stable — floats, carries security updates
unstable — tracks pre-releases, may break
eol — frozen, upstream is done

Tools in this project · pick one to inspect

capabilities differ between them

Tool Capabilities Seccomp Findings Image Description

php rw default

C3H20M6L4

php The PHP command line interpreter php-config nomount default

C3H20M6L4

php Report the build configuration of the installed PHP phpize rw default

C3H20M6L4

php Prepare a PHP extension's build environment

showing php php-config phpize from php@latest → 8.5.10 stable [email protected] → 8.5.10 stable [email protected] → 8.4.25 stable [email protected] → 8.3.33 stable [email protected] → 8.2.33 stable

Findings

C3H20M6L4

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description

CVE-2026-19931 ↗ C 9.8 curl A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials.

CVE-2026-18924 ↗ C 9.1 curl A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.

CVE-2026-66032 ↗ H 8.7 libssh2 libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session.

CVE-2026-66033 ↗ H 8.7 libssh2 libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by…

CVE-2026-74860 ↗ H 8.5 libxml2 A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values.

CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.

CVE-2026-82209 ↗ H 8.2 curl When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g.…

CVE-2026-86145 ↗ H 8.2 pcre2 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a…

CVE-2026-11979 ↗ H 7.8 libxml2 libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.

CVE-2026-86138 ↗ H 7.8 libxml2 In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

CVE-2026-86139 ↗ H 7.8 libxml2 In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

CVE-2026-86140 ↗ H 7.8 libxml2 In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

CVE-2026-86142 ↗ H 7.8 libxml2 In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

CVE-2026-86144 ↗ H 7.8 libxml2 In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the…

CVE-2026-66035 ↗ H 7.7 libssh2 libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length…

CVE-2026-80229 ↗ H 7.5 curl When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles.

CVE-2026-80230 ↗ H 7.5 curl When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established…

CVE-2026-80255 ↗ H 7.5 curl A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag.

CVE-2026-8932 ↗ H 7.5 curl libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.

CVE-2026-13608 ↗ H 7.4 curl A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification.

CVE-2026-89161 ↗ H 7.4 pcre2 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

CVE-2026-86143 ↗ H 7.3 libxml2 In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback.

CVE-2026-89158 ↗ M 6.5 pcre2 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.

CVE-2026-13757 ↗ M 6.2 p11-kit A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing…

CVE-2026-18938 ↗ M 6.2 p11-kit A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability.

CVE-2026-86137 ↗ M 6.1 libxml2 In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

CVE-2026-89157 ↗ M 5.7 pcre2 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.

CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…

CVE-2026-89160 ↗ L 3.7 pcre2 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.

CVE-2026-86141 ↗ L 3.3 libxml2 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

CVE-2026-89156 ↗ L 2.9 pcre2 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

CVE-2026-89162 ↗ L 2.9 pcre2 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

2 further advisories matched this image and were assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed

CVE-2026-27171 zlib not affected · vex

CVE-2026-42250 bzip2 not affected · vex

These are the findings of php, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.