Vulnerability · Published Oct 8, 2024 · Assigned by php

CVE-2024-8925Erroneous parsing of multipart form data

Low 3.1

In plain English

A low-severity security flaw in PHP from PHP Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.9%top 39.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2024:10951
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2024:10951
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2024:10951
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2024:10951
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-bcmath8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-bcmath7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-bcmath8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-bcmath8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-cli8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-cli7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-cli8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-cli8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-common7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-common8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-common8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-common8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-dba7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-dba8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-dba8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-dba8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-dbg7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-dbg8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-dbg8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-dbg8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-devel7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-devel8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-devel8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-devel8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-embedded7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-embedded8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-embedded8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-embedded8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-enchant8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-enchant7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-enchant8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-enchant8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-ffi8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-ffi7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-ffi8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-ffi8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-fpm7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-fpm8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-fpm8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-fpm8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-gd8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-gd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gd8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-gd8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-gmp8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-gmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gmp8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-gmp8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-intl7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-intl8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-intl8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-intl8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-json7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-ldap8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-ldap8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-mbstring8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-mbstring7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-mbstring8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-mbstring8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-mysqlnd8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-mysqlnd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-mysqlnd8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-mysqlnd8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-odbc8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-odbc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-odbc8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-odbc8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-opcache8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-opcache7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-opcache8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-opcache8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-pdo7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pdo8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-pdo8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-pdo8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.3.0+2009+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.4.0+2229+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3059+d65eee13ALSA-2024:10952
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2024:10950
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:10949
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8php-pgsql7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pgsql8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-pgsql8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-pgsql8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-process8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-process7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-process8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-process8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-snmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-snmp8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-snmp8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-snmp8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-soap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-soap8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-soap8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-soap8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-xml7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-xml8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-xml8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-xml8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-xmlrpc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
Alpine:v3.20php828.2.24-r0ALPINE-CVE-2024-8925
Alpine:v3.20php838.3.12-r0ALPINE-CVE-2024-8925
Debian:12php8.28.2.24-1~deb12u1DSA-5780-1
Debian:12php8.28.2.24-1~deb12u1DEBIAN-CVE-2024-8925
Rocky Linux:8libzip0:1.7.3-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php0:7.4.33-2.module+el8.10.0+1912+72767185RLSA-2024:10952
Rocky Linux:8php0:8.2.25-1.module+el8.10.0+1911+f499711eRLSA-2024:10951
Rocky Linux:8php-pear1:1.10.14-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-apcu0:5.1.23-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:9php-pecl-apcu0:5.1.23-1.module+el9.6.0+32042+808943aeRLSA-2024:10949
Rocky Linux:9php-pecl-apcu0:5.1.21-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Rocky Linux:9php-pecl-apcu0:5.1.23-1.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-rrd0:2.0.3-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:10949
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:10949
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:10950
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:10950
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-xdebug30:3.2.2-2.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:9php-pecl-xdebug30:3.1.4-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Rocky Linux:9php-pecl-xdebug30:3.2.2-2.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-zip0:1.22.3-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:9php-pecl-zip0:1.22.3-1.module+el9.6.0+32042+808943aeRLSA-2024:10949
Rocky Linux:9php-pecl-zip0:1.22.3-1.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:9php-pecl-zip0:1.20.1-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.19UBUNTU-CVE-2024-8925
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.19USN-7049-1
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.2USN-7049-1
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.2UBUNTU-CVE-2024-8925

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.1.* – before 8.1.308.2.* – before 8.2.248.3.* – before 8.3.12

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References