PHP 8.2 end of life and support status
Security fixes only. Ends in 99 days (December 31, 2026).
Key dates
- Released
- December 8, 2022
- Active support ended
- December 31, 2024
- Security support ends (end of life)
- December 31, 2026
- Latest release
- 8.2.33, July 30, 2026
Security fixes in PHP 8.2
43 security advisories fixed on this branch, newest first, with the release that fixed each one. Covers the advisories php-src has published on GitHub, which started in February 2023.
-
Stack overflow in phar with circular symlinks
-
SQL injection in ext-pgsql via E'...' backslash breakout
-
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
-
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
-
SoapServer session-persisted object use-after-free via SOAP header fault
-
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
-
XSS within PHP-FPM status endpoint
-
Use-After-Free in SOAP using Apache map with Remote Code Execution
-
Out-of-bounds read in urldecode()
-
SQL injection in pdo_firebird via NUL bytes in quoted strings
-
Signed integer overflow in metaphone()
-
Null byte termination in dns_get_record()
-
NULL Pointer Dereference in PDO quoting
-
Heap buffer overflow in array_merge()
-
Information Leak of Memory in getimagesize
-
pgsql extension does not check for errors during escaping
-
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
-
Null byte termination in hostnames
-
Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
-
libxml streams use wrong `content-type` header when requesting a redirected resource
-
Stream HTTP wrapper header check might omit basic auth header
-
Stream HTTP wrapper truncate redirect location to 1024 bytes
-
Streams HTTP wrapper does not fail for headers with invalid name and no colon
-
Header parser of `http` stream wrapper does not handle folded headers
-
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
-
OOB access in ldap_escape
-
Configuring a proxy in a stream context might allow for CRLF injection in URIs
-
Integer overflow in the firebird and dblib quoters causing OOB writes
-
Single byte overread with convert.quoted-printable-decode filter
-
Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
-
cgi.force_redirect configuration is bypassable due to the environment variable collision
-
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
-
Erroneous parsing of multipart form data
-
[PHP-FPM] Logs from childrens may be altered
-
PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
-
bypass CVE-2024-1874
-
Filter bypass in filter_var (FILTER_VALIDATE_URL)
-
password_verify can erroneously return true, opening ATO risk
-
Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
-
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
-
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
-
BCrypt hashes erroneously validate if the salt is cut short by `$`
-
DoS vulnerability when parsing multipart request body