CVE catalog
CVE-2026-6104
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly
- Severity
- High · CVSS 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.47% · Oct 25, 2026
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php8.2 | bookworm | 8.2.32-1~deb12u1 | not affected |
| Debian | php8.2 | bookworm-security | 8.2.35-1~deb12u1 | not affected |
| Cpe | php8.3 | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | libapache2-mod-php8.3 | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | libphp8.3-embed | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-bcmath | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-bz2 | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-cgi | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-cli | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-common | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-curl | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-dba | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-dev | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-enchant | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-fpm | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-gd | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-gmp | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-imap | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-interbase | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-intl | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-ldap | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-mbstring | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-mysql | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-odbc | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-opcache | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-pgsql | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-phpdbg | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-pspell | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-readline | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-snmp | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-soap | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-sqlite3 | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-sybase | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-tidy | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-xml | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-xsl | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php8.3-zip | Not reported | 8.3.6-0ubuntu0.24.04.9 | fixed |
| Cpe | php | Not reported | 8.4.21 | fixed |
| Cpe | php | Not reported | 8.5.6 | fixed |
| Ubuntu | php8.4 | 25.10 | 8.4.5-1ubuntu1 | vulnerable |
| Ubuntu | php8.4 | 25.10 | 8.4.8-1ubuntu1 | vulnerable |
| Ubuntu | php8.4 | 25.10 | 8.4.11-1ubuntu1 | vulnerable |
| Ubuntu | php8.4 | 25.10 | 8.4.11-1ubuntu1.1 | vulnerable |
| Ubuntu | php8.4 | 25.10 | 8.4.11-1ubuntu1.2 | fixed |
| Ubuntu | php8.5 | 26.04 | 8.5.2-0ubuntu1 | vulnerable |
| Ubuntu | php8.5 | 26.04 | 8.5.4-0ubuntu1 | vulnerable |
| Ubuntu | php8.5 | 26.04 | 8.5.4-0ubuntu1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php8.2 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | php8.3 | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | libapache2-mod-php8.3 | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | libphp8.3-embed | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-bcmath | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-bz2 | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-cgi | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-cli | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-common | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-curl | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-dba | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-dev | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-enchant | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-fpm | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-gd | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-gmp | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-imap | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-interbase | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-intl | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-ldap | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-mbstring | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-mysql | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-odbc | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-opcache | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-pgsql | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-phpdbg | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-pspell | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-readline | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-snmp | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-soap | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-sqlite3 | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-sybase | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-tidy | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-xml | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-xsl | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php8.3-zip | cpe | Not reported | 8.3.6-0ubuntu0.24.04.9 | Not reported | Not reported | Not reported |
| Cpe | php | cpe | Not reported | 8.4.21 | Not reported | Not reported | Not reported |
| Cpe | php | cpe | Not reported | 8.5.6 | Not reported | Not reported | Not reported |
| Ubuntu | php8.4 | deb | 25.10 | 8.4.11-1ubuntu1.2 | Not reported | UBUNTU-CVE-2026-6104 | Not reported |
| Ubuntu | php8.5 | deb | 26.04 | 8.5.4-0ubuntu1.1 | Not reported | UBUNTU-CVE-2026-6104 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libapache2-mod-php8.2]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [libphp8.2-embed]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2]Not affected
Details (4)
8.2.32-1~deb12u1· all · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· all · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· all · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· all · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-bcmath]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-bz2]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-cgi]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-cli]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-common]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-curl]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-dba]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-dev]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-enchant]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-fpm]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-gd]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-gmp]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-imap]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-interbase]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-intl]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-ldap]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
- [php8.2-mbstring]Not affected
Source package: [php8.2]
Details (4)
8.2.32-1~deb12u1· amd64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.32-1~deb12u1· arm64 · bookwormNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· amd64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
8.2.33-1~deb12u1· arm64 · bookworm-securityNot affected
nvd · php8.2 · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10747-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-6104]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-6104]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-6104]
- [https://security-tracker.debian.org/tracker/CVE-2026-6104]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.json]
- [https://ubuntu.com/security/notices/USN-8336-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1433.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]