On 4 June 2026 the PHP project released PHP 8.5.7 and 8.4.22. Both were announced as bug-fix releases, not security releases. The 8.5.7 ChangeLog nevertheless lists two CVE fixes in the URI extension, which PHP 8.5 introduced and which uses the bundled uriparser library. The 8.4.22 ChangeLog lists no security fixes.
At a glance
| Item | Details |
|---|---|
| Product | PHP 8.5 (URI extension, bundled uriparser) |
| Fixed version | 8.5.7 (4 June 2026) |
| CVEs | CVE-2026-44927, CVE-2026-44928 |
| Severity | Low (CVSS 3.1 2.9 in both CVE records) |
| Not affected | PHP 8.2, 8.3 and 8.4, which have no URI extension |
What the vulnerabilities are
PHP 8.5 added an always-available URI extension that parses and normalises URLs according to RFC 3986 and the WHATWG URL standard. The RFC 3986 side is powered by uriparser, which php-src ships in ext/uri/uriparser. In the php-src tree, the bundled copy moved from uriparser 1.0.1 in the 8.5.6 tag to 1.0.2 in the 8.5.7 tag, picking up fixes for two upstream issues:
- CVE-2026-44927: in uriparser before 1.0.2, pointer differences were truncated to
intin several places. - CVE-2026-44928: in uriparser before 1.0.2, the
EqualsUrifamily of functions can classify two different URIs as equal.
Both CVE records come from MITRE as the CNA and rate the issues CVSS 3.1 2.9 (Low), with a local attack vector and high attack complexity. The PHP project did not publish a separate GitHub security advisory or severity for them. For context, PHP's own Uri\Rfc3986\Uri::equals() method in 8.5.7 compares the serialised URI strings rather than calling uriparser's EqualsUri, according to the php-src source. Neither CVE is in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).
Are you affected?
Only PHP 8.5 builds older than 8.5.7 contain the older uriparser. Check your version:
php -v
php -r 'echo PHP_VERSION, PHP_EOL;'Debian 13 (trixie) ships PHP 8.4 and has no php8.5 source package, so Debian's own PHP packages are not involved. Debian's separate uriparser library package is tracked for CVE-2026-44928 on the security tracker, where the security team marked it as a minor issue without a DSA for trixie and bookworm. If you install PHP 8.5 from another repository, a container image or a source build, the version check above is what counts.
How to update
Update PHP 8.5 to the newest release rather than to 8.5.7 itself. Later 8.5 releases contain further security fixes; as of 31 October 2026 the current version is 8.5.12. Use the channel you installed PHP from: your package repository, a rebuilt container image, or the source and Windows downloads on php.net/downloads.
Restart or reboot?
No reboot is needed. Restart PHP-FPM, Apache with mod_php, and long-running PHP workers so they load the new build.
Sources
- php.net/releases/8_5_7.php
- php.net/releases/8_4_22.php
- php.net/ChangeLog-8.php#8.5.7
- php.net/releases/8.5/en.php
- github.com/php/php-src/tree/php-8.5.7/ext/uri/uriparser
- github.com/php/php-src/blob/php-8.5.7/ext/uri/php_uri.c
- cve.org/CVERecord?id=CVE-2026-44927
- cve.org/CVERecord?id=CVE-2026-44928
- nvd.nist.gov/vuln/detail/CVE-2026-44928
- security-tracker.debian.org/tracker/CVE-2026-44928
- packages.debian.org/source/trixie/php8.4
- cisa.gov/known-exploited-vulnerabilities-catalog
Comments
0 total · 0 threads