Vulnerability · Published Apr 4, 2025 · Assigned by php
CVE-2024-11235Reference counting in php_request_shutdown causes Use-After-Free
Critical 9.2
In plain English
A critical-severity use-after-free in PHP from PHP Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)1.5%top 25.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | apcu-panel | 5.1.23-1.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:10 | php | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-bcmath | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-bcmath | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-cli | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-cli | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-common | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-common | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-dba | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-dba | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-dbg | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-dbg | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-devel | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-devel | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-embedded | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-embedded | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-enchant | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-enchant | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-ffi | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-ffi | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-fpm | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-fpm | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-gd | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-gd | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-gmp | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-gmp | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-intl | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-intl | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-ldap | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-ldap | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-mbstring | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-mbstring | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-mysqlnd | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-mysqlnd | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-odbc | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-odbc | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-opcache | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-opcache | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-pdo | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-pdo | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:9 | php-pecl-apcu | 5.1.23-1.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:9 | php-pecl-apcu-devel | 5.1.23-1.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:9 | php-pecl-redis6 | 6.1.0-2.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:9 | php-pecl-rrd | 2.0.3-4.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:9 | php-pecl-xdebug3 | 3.3.1-1.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:9 | php-pecl-zip | 1.22.3-1.module_el9.6.0+151+5f31e576 | ALSA-2025:7418 |
| AlmaLinux:10 | php-pgsql | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-pgsql | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-process | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-process | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-snmp | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-snmp | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-soap | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-soap | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| AlmaLinux:10 | php-xml | 8.3.19-1.el10_0 | ALSA-2025:7489 |
| AlmaLinux:9 | php-xml | 8.3.19-1.module_el9.6.0+166+f262c21c | ALSA-2025:7418 |
| Alpine:v3.21 | php83 | 8.3.18-r0 | ALPINE-CVE-2024-11235 |
| Alpine:v3.22 | php83 | 8.3.18-r0 | ALPINE-CVE-2024-11235 |
| Alpine:v3.23 | php83 | 8.3.18-r0 | ALPINE-CVE-2024-11235 |
| Alpine:v3.24 | php83 | 8.3.18-r0 | ALPINE-CVE-2024-11235 |
| Debian:13 | php8.4 | 8.4.5-1 | DEBIAN-CVE-2024-11235 |
| Debian:14 | php8.4 | 8.4.5-1 | DEBIAN-CVE-2024-11235 |
| Rocky Linux:10 | php | 0:8.3.19-1.el10_0 | RLSA-2025:7489 |
| Rocky Linux:9 | php-pecl-apcu | 0:5.1.23-1.module+el9.5.0+29598+58484504 | RLSA-2025:7418 |
| Rocky Linux:9 | php-pecl-rrd | 0:2.0.3-4.module+el9.5.0+29598+58484504 | RLSA-2025:7418 |
| Rocky Linux:9 | php-pecl-rrd | 0:2.0.3-4.module+el9.5.0+31393+1f1dedb8 | RLSA-2025:7418 |
| Rocky Linux:9 | php-pecl-zip | 0:1.22.3-1.module+el9.5.0+29598+58484504 | RLSA-2025:7418 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.21 | USN-7400-1 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.21 | UBUNTU-CVE-2024-11235 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.4 | USN-7400-1 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.4 | UBUNTU-CVE-2024-11235 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Amber