PHP 8.4 end of life and support status
Active support until December 31, 2026.
Key dates
- Released
- November 21, 2024
- Active support ends
- December 31, 2026
- Security support ends (end of life)
- December 31, 2028
- Latest release
- 8.4.26, September 24, 2026
Security fixes in PHP 8.4
41 security advisories fixed on this branch, newest first, with the release that fixed each one. Covers the advisories php-src has published on GitHub, which started in February 2023.
-
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
-
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
-
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
-
TLS Hostname Verification Falls Back to CN After SAN Mismatch
-
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
-
Various packet overreads in mysqlnd_writeprotocol.c
-
Cross-origin credential leak in HTTP stream wrapper redirects
-
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
-
Integer overflow to buffer overflow in soap HTTP parsing
-
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
-
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
-
ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
-
Stack overflow in phar with circular symlinks
-
Out-of-bounds write in bccomp() via crafted operand and scale
-
SQL injection in ext-pgsql via E'...' backslash breakout
-
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
-
Failure to setup TLS with a remote server can result in a remote DoS
-
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
-
SoapServer session-persisted object use-after-free via SOAP header fault
-
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
-
XSS within PHP-FPM status endpoint
-
Use-After-Free in SOAP using Apache map with Remote Code Execution
-
Out-of-bounds read in urldecode()
-
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
-
SQL injection in pdo_firebird via NUL bytes in quoted strings
-
Signed integer overflow in metaphone()
-
DoS attack via DOMNode::C14N()
-
Null byte termination in dns_get_record()
-
NULL Pointer Dereference in PDO quoting
-
Heap buffer overflow in array_merge()
-
Information Leak of Memory in getimagesize
-
pgsql extension does not check for errors during escaping
-
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
-
Null byte termination in hostnames
-
Reference counting in php_request_shutdown causes Use-After-Free
-
Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
-
libxml streams use wrong `content-type` header when requesting a redirected resource
-
Stream HTTP wrapper header check might omit basic auth header
-
Stream HTTP wrapper truncate redirect location to 1024 bytes
-
Streams HTTP wrapper does not fail for headers with invalid name and no colon
-
Header parser of `http` stream wrapper does not handle folded headers