CVE catalog

CVE-2026-91766

PHP vulnerabilities

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Sep 23, 2026, 11:22:35 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.29% · Oct 27, 2026

Projects and upstream resources

[php8.4][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "php8.2",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "8.2.32-1~deb12u1"
    },
    {
      "name": "php8.2",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "8.2.35-1~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "php8.2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "8.2.34-1~deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "php8.3",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "libapache2-mod-php8.3",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "libphp8.3-embed",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-bcmath",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-bz2",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-cgi",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-cli",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-common",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-curl",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-dba",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-dev",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-enchant",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-fpm",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-gd",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-gmp",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-imap",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-interbase",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-intl",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-ldap",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-mbstring",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-mysql",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-odbc",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-opcache",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-pgsql",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-phpdbg",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-pspell",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-readline",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-snmp",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-soap",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-sqlite3",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-sybase",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-tidy",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-xml",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-xsl",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php8.3-zip",
      "distro": "ubuntu",
      "ranges": [
        {
          "fixed": "8.3.6-0ubuntu0.24.04.12",
          "introduced": "0"
        }
      ],
      "release": "noble",
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12"
    },
    {
      "name": "php",
      "ranges": [
        {
          "fixed": "8.5.11",
          "introduced": "8.5.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "8.5.11",
      "provider_record_id": "NVD-CVE-2026-91766"
    },
    {
      "name": "php5",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.9+dfsg-1ubuntu4.29+esm17"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "5.5.3+dfsg-1ubuntu2",
        "5.5.3+dfsg-1ubuntu3",
        "5.5.6+dfsg-1ubuntu1",
        "5.5.6+dfsg-1ubuntu2",
        "5.5.8+dfsg-2ubuntu1",
        "5.5.9+dfsg-1ubuntu1",
        "5.5.9+dfsg-1ubuntu2",
        "5.5.9+dfsg-1ubuntu3",
        "5.5.9+dfsg-1ubuntu4",
        "5.5.9+dfsg-1ubuntu4.1",
        "5.5.9+dfsg-1ubuntu4.2",
        "5.5.9+dfsg-1ubuntu4.3",
        "5.5.9+dfsg-1ubuntu4.4",
        "5.5.9+dfsg-1ubuntu4.5",
        "5.5.9+dfsg-1ubuntu4.6",
        "5.5.9+dfsg-1ubuntu4.7",
        "5.5.9+dfsg-1ubuntu4.9",
        "5.5.9+dfsg-1ubuntu4.11",
        "5.5.9+dfsg-1ubuntu4.12",
        "5.5.9+dfsg-1ubuntu4.13",
        "5.5.9+dfsg-1ubuntu4.14",
        "5.5.9+dfsg-1ubuntu4.16",
        "5.5.9+dfsg-1ubuntu4.17",
        "5.5.9+dfsg-1ubuntu4.19",
        "5.5.9+dfsg-1ubuntu4.20",
        "5.5.9+dfsg-1ubuntu4.21",
        "5.5.9+dfsg-1ubuntu4.22",
        "5.5.9+dfsg-1ubuntu4.23",
        "5.5.9+dfsg-1ubuntu4.24",
        "5.5.9+dfsg-1ubuntu4.25",
        "5.5.9+dfsg-1ubuntu4.26",
        "5.5.9+dfsg-1ubuntu4.27",
        "5.5.9+dfsg-1ubuntu4.29",
        "5.5.9+dfsg-1ubuntu4.29+esm1",
        "5.5.9+dfsg-1ubuntu4.29+esm2",
        "5.5.9+dfsg-1ubuntu4.29+esm3",
        "5.5.9+dfsg-1ubuntu4.29+esm4",
        "5.5.9+dfsg-1ubuntu4.29+esm5",
        "5.5.9+dfsg-1ubuntu4.29+esm6",
        "5.5.9+dfsg-1ubuntu4.29+esm8",
        "5.5.9+dfsg-1ubuntu4.29+esm10",
        "5.5.9+dfsg-1ubuntu4.29+esm11",
        "5.5.9+dfsg-1ubuntu4.29+esm12",
        "5.5.9+dfsg-1ubuntu4.29+esm13",
        "5.5.9+dfsg-1ubuntu4.29+esm14",
        "5.5.9+dfsg-1ubuntu4.29+esm15",
        "5.5.9+dfsg-1ubuntu4.29+esm16"
      ],
      "ecosystem": "deb",
      "fixed_version": "5.5.9+dfsg-1ubuntu4.29+esm17",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php7.0",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.33-0ubuntu0.16.04.16+esm21"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.0.1-5",
        "7.0.1-6",
        "7.0.2-1",
        "7.0.2-3",
        "7.0.2-4",
        "7.0.2-5",
        "7.0.3-2",
        "7.0.3-3",
        "7.0.3-9ubuntu1",
        "7.0.4-5ubuntu1",
        "7.0.4-5ubuntu2",
        "7.0.4-7ubuntu1",
        "7.0.4-7ubuntu2",
        "7.0.4-7ubuntu2.1",
        "7.0.8-0ubuntu0.16.04.1",
        "7.0.8-0ubuntu0.16.04.2",
        "7.0.8-0ubuntu0.16.04.3",
        "7.0.13-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.2",
        "7.0.15-0ubuntu0.16.04.4",
        "7.0.18-0ubuntu0.16.04.1",
        "7.0.22-0ubuntu0.16.04.1",
        "7.0.25-0ubuntu0.16.04.1",
        "7.0.28-0ubuntu0.16.04.1",
        "7.0.30-0ubuntu0.16.04.1",
        "7.0.32-0ubuntu0.16.04.1",
        "7.0.33-0ubuntu0.16.04.1",
        "7.0.33-0ubuntu0.16.04.2",
        "7.0.33-0ubuntu0.16.04.3",
        "7.0.33-0ubuntu0.16.04.4",
        "7.0.33-0ubuntu0.16.04.5",
        "7.0.33-0ubuntu0.16.04.6",
        "7.0.33-0ubuntu0.16.04.7",
        "7.0.33-0ubuntu0.16.04.9",
        "7.0.33-0ubuntu0.16.04.11",
        "7.0.33-0ubuntu0.16.04.12",
        "7.0.33-0ubuntu0.16.04.14",
        "7.0.33-0ubuntu0.16.04.15",
        "7.0.33-0ubuntu0.16.04.16",
        "7.0.33-0ubuntu0.16.04.16+esm1",
        "7.0.33-0ubuntu0.16.04.16+esm2",
        "7.0.33-0ubuntu0.16.04.16+esm3",
        "7.0.33-0ubuntu0.16.04.16+esm4",
        "7.0.33-0ubuntu0.16.04.16+esm5",
        "7.0.33-0ubuntu0.16.04.16+esm6",
        "7.0.33-0ubuntu0.16.04.16+esm7",
        "7.0.33-0ubuntu0.16.04.16+esm8",
        "7.0.33-0ubuntu0.16.04.16+esm9",
        "7.0.33-0ubuntu0.16.04.16+esm10",
        "7.0.33-0ubuntu0.16.04.16+esm11",
        "7.0.33-0ubuntu0.16.04.16+esm12",
        "7.0.33-0ubuntu0.16.04.16+esm13",
        "7.0.33-0ubuntu0.16.04.16+esm14",
        "7.0.33-0ubuntu0.16.04.16+esm15",
        "7.0.33-0ubuntu0.16.04.16+esm16",
        "7.0.33-0ubuntu0.16.04.16+esm17",
        "7.0.33-0ubuntu0.16.04.16+esm18",
        "7.0.33-0ubuntu0.16.04.16+esm19",
        "7.0.33-0ubuntu0.16.04.16+esm20"
      ],
      "ecosystem": "deb",
      "fixed_version": "7.0.33-0ubuntu0.16.04.16+esm21",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php7.2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.24-0ubuntu0.18.04.17+esm13"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.2.1-1ubuntu2",
        "7.2.2-1ubuntu1",
        "7.2.2-1ubuntu2",
        "7.2.3-1ubuntu1",
        "7.2.5-0ubuntu0.18.04.1",
        "7.2.7-0ubuntu0.18.04.1",
        "7.2.7-0ubuntu0.18.04.2",
        "7.2.10-0ubuntu0.18.04.1",
        "7.2.15-0ubuntu0.18.04.1",
        "7.2.15-0ubuntu0.18.04.2",
        "7.2.17-0ubuntu0.18.04.1",
        "7.2.19-0ubuntu0.18.04.1",
        "7.2.19-0ubuntu0.18.04.2",
        "7.2.24-0ubuntu0.18.04.1",
        "7.2.24-0ubuntu0.18.04.2",
        "7.2.24-0ubuntu0.18.04.3",
        "7.2.24-0ubuntu0.18.04.4",
        "7.2.24-0ubuntu0.18.04.6",
        "7.2.24-0ubuntu0.18.04.7",
        "7.2.24-0ubuntu0.18.04.8",
        "7.2.24-0ubuntu0.18.04.9",
        "7.2.24-0ubuntu0.18.04.10",
        "7.2.24-0ubuntu0.18.04.11",
        "7.2.24-0ubuntu0.18.04.12",
        "7.2.24-0ubuntu0.18.04.13",
        "7.2.24-0ubuntu0.18.04.15",
        "7.2.24-0ubuntu0.18.04.16",
        "7.2.24-0ubuntu0.18.04.17",
        "7.2.24-0ubuntu0.18.04.17+esm1",
        "7.2.24-0ubuntu0.18.04.17+esm2",
        "7.2.24-0ubuntu0.18.04.17+esm3",
        "7.2.24-0ubuntu0.18.04.17+esm4",
        "7.2.24-0ubuntu0.18.04.17+esm5",
        "7.2.24-0ubuntu0.18.04.17+esm6",
        "7.2.24-0ubuntu0.18.04.17+esm7",
        "7.2.24-0ubuntu0.18.04.17+esm8",
        "7.2.24-0ubuntu0.18.04.17+esm9",
        "7.2.24-0ubuntu0.18.04.17+esm10",
        "7.2.24-0ubuntu0.18.04.17+esm11",
        "7.2.24-0ubuntu0.18.04.17+esm12"
      ],
      "ecosystem": "deb",
      "fixed_version": "7.2.24-0ubuntu0.18.04.17+esm13",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php7.4",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.4.3-4ubuntu2.29+esm4"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.4.3-4build1",
        "7.4.3-4build2",
        "7.4.3-4ubuntu1",
        "7.4.3-4ubuntu1.1",
        "7.4.3-4ubuntu2.2",
        "7.4.3-4ubuntu2.4",
        "7.4.3-4ubuntu2.5",
        "7.4.3-4ubuntu2.6",
        "7.4.3-4ubuntu2.7",
        "7.4.3-4ubuntu2.8",
        "7.4.3-4ubuntu2.9",
        "7.4.3-4ubuntu2.10",
        "7.4.3-4ubuntu2.11",
        "7.4.3-4ubuntu2.12",
        "7.4.3-4ubuntu2.13",
        "7.4.3-4ubuntu2.15",
        "7.4.3-4ubuntu2.16",
        "7.4.3-4ubuntu2.17",
        "7.4.3-4ubuntu2.18",
        "7.4.3-4ubuntu2.19",
        "7.4.3-4ubuntu2.20",
        "7.4.3-4ubuntu2.22",
        "7.4.3-4ubuntu2.23",
        "7.4.3-4ubuntu2.24",
        "7.4.3-4ubuntu2.26",
        "7.4.3-4ubuntu2.28",
        "7.4.3-4ubuntu2.29",
        "7.4.3-4ubuntu2.29+esm1",
        "7.4.3-4ubuntu2.29+esm2",
        "7.4.3-4ubuntu2.29+esm3"
      ],
      "ecosystem": "deb",
      "fixed_version": "7.4.3-4ubuntu2.29+esm4",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php8.1",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.1.2-1ubuntu2.27"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "8.1.0~rc4-1ubuntu2",
        "8.1.0-1",
        "8.1.2-1ubuntu1",
        "8.1.2-1ubuntu2",
        "8.1.2-1ubuntu2.1",
        "8.1.2-1ubuntu2.2",
        "8.1.2-1ubuntu2.3",
        "8.1.2-1ubuntu2.4",
        "8.1.2-1ubuntu2.5",
        "8.1.2-1ubuntu2.6",
        "8.1.2-1ubuntu2.8",
        "8.1.2-1ubuntu2.9",
        "8.1.2-1ubuntu2.10",
        "8.1.2-1ubuntu2.11",
        "8.1.2-1ubuntu2.13",
        "8.1.2-1ubuntu2.14",
        "8.1.2-1ubuntu2.15",
        "8.1.2-1ubuntu2.17",
        "8.1.2-1ubuntu2.18",
        "8.1.2-1ubuntu2.19",
        "8.1.2-1ubuntu2.20",
        "8.1.2-1ubuntu2.21",
        "8.1.2-1ubuntu2.22",
        "8.1.2-1ubuntu2.23",
        "8.1.2-1ubuntu2.24",
        "8.1.2-1ubuntu2.25",
        "8.1.2-1ubuntu2.26"
      ],
      "ecosystem": "deb",
      "fixed_version": "8.1.2-1ubuntu2.27",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php8.3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.3.6-0ubuntu0.24.04.12"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "8.3.0-1",
        "8.3.0-1ubuntu1",
        "8.3.4-1",
        "8.3.4-1build1",
        "8.3.6-0maysync1",
        "8.3.6-0ubuntu0.24.04.1",
        "8.3.6-0ubuntu0.24.04.2",
        "8.3.6-0ubuntu0.24.04.3",
        "8.3.6-0ubuntu0.24.04.4",
        "8.3.6-0ubuntu0.24.04.5",
        "8.3.6-0ubuntu0.24.04.6",
        "8.3.6-0ubuntu0.24.04.7",
        "8.3.6-0ubuntu0.24.04.8",
        "8.3.6-0ubuntu0.24.04.9",
        "8.3.6-0ubuntu0.24.04.10",
        "8.3.6-0ubuntu0.24.04.11"
      ],
      "ecosystem": "deb",
      "fixed_version": "8.3.6-0ubuntu0.24.04.12",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php8.5",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.9-0ubuntu2"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "8.5.4-0ubuntu1",
        "8.5.4-0ubuntu3",
        "8.5.9-0ubuntu1"
      ],
      "ecosystem": "deb",
      "fixed_version": "8.5.9-0ubuntu2",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    },
    {
      "name": "php8.5",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.4-0ubuntu1.4"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "8.5.2-0ubuntu1",
        "8.5.4-0ubuntu1",
        "8.5.4-0ubuntu1.1",
        "8.5.4-0ubuntu1.2",
        "8.5.4-0ubuntu1.3"
      ],
      "ecosystem": "deb",
      "fixed_version": "8.5.4-0ubuntu1.4",
      "provider_record_id": "UBUNTU-CVE-2026-91766"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libapache2-mod-php8.2]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[libphp8.2-embed]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2]Unknown
Details (4)
- 8.2.32-1~deb12u1 · all · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · all · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · all · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · all · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-bcmath]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-bz2]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-cgi]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-cli]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-common]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-curl]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-dba]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-dev]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-enchant]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-fpm]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-gd]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-gmp]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-imap]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-interbase]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-intl]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-ldap]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
[php8.2-mbstring]Unknown
Source package: [php8.2]
Details (4)
- 8.2.32-1~deb12u1 · amd64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.32-1~deb12u1 · arm64 · bookworm
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12
- 8.2.33-1~deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 8.2.34-1~deb12u1
  usn · php8.2 · debian · bookworm; usn · php8.2 · debian · 12

Next results

Observed: Oct 27, 2026, 5:43:47 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]