Vulnerability · Published May 10, 2026 · Assigned by php

CVE-2026-7258Out-of-bounds read in urldecode() on NetBSD

Medium 6.3

In plain English

A medium-severity out-of-bounds read in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9apcu-panel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:10php8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-bcmath8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-bcmath8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-bcmath7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-bcmath8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-bcmath8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-bcmath8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-cli8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-cli8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-cli7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-cli8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-cli8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-cli8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-common8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-common8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-common7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-common8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-common8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-common8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-dba8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-dba8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-dba7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-dba8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-dba8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-dba8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-dbg8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-dbg8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-dbg7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-dbg8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-dbg8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-dbg8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-devel8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-devel8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-devel7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-devel8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-devel8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-devel8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-embedded8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-embedded8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-embedded7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-embedded8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-embedded8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-embedded8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-enchant8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-enchant7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-enchant8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-enchant8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-enchant8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-enchant8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-ffi8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-ffi8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-ffi7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-ffi8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-ffi8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-ffi8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-fpm8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-fpm8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-fpm7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-fpm8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-fpm8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-fpm8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-gd8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-gd8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-gd7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-gd8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-gd8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-gd8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-gmp8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-gmp8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-gmp7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-gmp8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-gmp8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-gmp8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-intl8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-intl7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-intl8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-intl8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-intl8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-intl8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:8php-json7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:10php-ldap8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-ldap7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-ldap8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-ldap8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-ldap8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-ldap8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-mbstring8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-mbstring7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-mbstring8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-mbstring8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-mbstring8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-mbstring8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-mysqlnd8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-mysqlnd7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-mysqlnd8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-mysqlnd8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-mysqlnd8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-mysqlnd8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-odbc8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-odbc7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-odbc8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-odbc8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-odbc8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-odbc8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-opcache8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-opcache7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-opcache8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-opcache8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-opcache8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-opcache8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-pdo8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-pdo7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-pdo8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-pdo8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-pdo8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-pdo8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-redis66.1.0-2.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2026:34354
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2026:34354
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:22305
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2026:34354
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.6.0+151+5f31e576ALSA-2026:22142
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2026:22143
AlmaLinux:10php-pgsql8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-pgsql7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-pgsql8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-pgsql8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-pgsql8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-pgsql8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-process8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-process7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-process8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-process8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-process8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-process8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:10php-snmp8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-snmp8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-snmp7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-snmp8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-snmp8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:9php-snmp8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:10php-soap8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-soap7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:8php-soap8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:9php-soap8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-soap8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-soap8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:10php-xml8.3.31-1.el10_2ALSA-2026:23388
AlmaLinux:8php-xml8.2.31-1.module_el8.10.0+4189+0784d4ccALSA-2026:22305
AlmaLinux:8php-xml7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:9php-xml8.2.31-1.module_el9.8.0+254+5708f44cALSA-2026:22143
AlmaLinux:9php-xml8.3.31-2.module_el9.8.0+255+747189f2ALSA-2026:22142
AlmaLinux:9php-xml8.0.30-6.el9_8ALSA-2026:33449
AlmaLinux:8php-xmlrpc7.4.33-4.module_el8.10.0+4209+2ed16ff0ALSA-2026:34354
AlmaLinux:10php8.48.4.21-1.el10_2ALSA-2026:22649
AlmaLinux:10php8.4-bcmath8.4.21-1.el10_2ALSA-2026:22649

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.2.* – before 8.2.318.3.* – before 8.3.318.4.* – before 8.4.218.5.* – before 8.5.6

Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/U:Amber

References