PHP 8.1 end of life and support status
End of life since December 31, 2025. No more fixes, including security.
Key dates
- Released
- November 25, 2021
- Active support ended
- November 25, 2023
- Security support ended (end of life)
- December 31, 2025
- Latest release
- 8.1.34, December 18, 2025
Security fixes in PHP 8.1
32 security advisories fixed on this branch, newest first, with the release that fixed each one. Covers the advisories php-src has published on GitHub, which started in February 2023.
-
Null byte termination in dns_get_record()
-
NULL Pointer Dereference in PDO quoting
-
Heap buffer overflow in array_merge()
-
Information Leak of Memory in getimagesize
-
pgsql extension does not check for errors during escaping
-
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
-
Null byte termination in hostnames
-
Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
-
libxml streams use wrong `content-type` header when requesting a redirected resource
-
Stream HTTP wrapper header check might omit basic auth header
-
Stream HTTP wrapper truncate redirect location to 1024 bytes
-
Streams HTTP wrapper does not fail for headers with invalid name and no colon
-
Header parser of `http` stream wrapper does not handle folded headers
-
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
-
OOB access in ldap_escape
-
Configuring a proxy in a stream context might allow for CRLF injection in URIs
-
Integer overflow in the firebird and dblib quoters causing OOB writes
-
Single byte overread with convert.quoted-printable-decode filter
-
Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
-
cgi.force_redirect configuration is bypassable due to the environment variable collision
-
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
-
Erroneous parsing of multipart form data
-
[PHP-FPM] Logs from childrens may be altered
-
PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
-
bypass CVE-2024-1874
-
Filter bypass in filter_var (FILTER_VALIDATE_URL)
-
password_verify can erroneously return true, opening ATO risk
-
Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
-
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
-
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
-
BCrypt hashes erroneously validate if the salt is cut short by `$`
-
DoS vulnerability when parsing multipart request body