WS-2026-0172
Published:September 24, 2026
Updated:October 23, 2026
In PHP 5.2.1 through 8.1.34, 8.2.x before 8.2.34, 8.3.x before 8.3.34, 8.4.x before 8.4.25 and 8.5.x before 8.5.10, php_filter_encode_url() in ext/filter/sanitizing_filters.c initialises only the first 255 entries of its 256-entry lookup table, so FILTER_SANITIZE_ENCODED decides whether to percent-encode the byte 0xFF from uninitialised stack memory. As a result 0xFF can pass through unencoded.
Affected Packages
php (CONDA):
Affected version(s) >=8.5.4 <8.5.10Fix Suggestion:
Update to version 8.5.10https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.2.0alpha1 <php-8.2.34Fix Suggestion:
Update to version php-8.2.34https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.5.0alpha1 <php-8.5.10Fix Suggestion:
Update to version php-8.5.10https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.3.0alpha1 <php-8.3.34Fix Suggestion:
Update to version php-8.3.34https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.4.0alpha1 <php-8.4.25Fix Suggestion:
Update to version php-8.4.25Related Resources (3)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Use of Uninitialized Resource