| Package | Affected versions | Patched versions |
|---|---|---|
| php | ≥ 8.2.0, < 8.2.31≥ 8.3.0, < 8.3.31≥ 8.4.0, < 8.4.21≥ 8.5.0, < 8.5.6 | 8.2.318.3.318.4.218.5.6 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free