PHP : déni de service

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   php -v
   php-fpm -v

2. Corriger

   Versions corrigées : php7.2 7.2.24-0ubuntu0.18.04.17+esm13 (bionic), php7.4 7.4.3-4ubuntu2.29+esm4 (focal), php8.1 8.1.2-1ubuntu2.27 (jammy), php8.3 8.3.6-0ubuntu0.24.04.12 (noble), php8.5 8.5.4-0ubuntu1.4 (resolute), php8.5 8.5.9-0ubuntu2 (stonking), php5 5.5.9+dfsg-1ubuntu4.29+esm17 (trusty), php7.0 7.0.33-0ubuntu0.16.04.16+esm21 (xenial).

   Mettre à jour PHP (paquets de la distribution ou version officielle), puis redémarrer tous les processus PHP : PHP-FPM, Apache avec mod_php, workers.

   Migrer toute branche qui ne reçoit plus de correctifs (voir le panneau « Versions de référence »).

   sudo apt update && sudo apt install --only-upgrade "php*"
   sudo systemctl restart php*-fpm apache2

3. En attendant le correctif

   Bloquer ou filtrer au pare-feu applicatif (WAF) les requêtes qui exploitent la faille, si une règle est publiée.

   Isoler du réseau les serveurs exposés qui ne peuvent pas être corrigés rapidement.

4. Contrôler

   php -v doit afficher la version corrigée, y compris pour PHP-FPM (php-fpm -v) et dans un phpinfo() servi par le site.

   Rechercher dans les journaux d'accès des requêtes anormales depuis la date de divulgation.

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

Several security issues were fixed in PHP. It was discovered that PHP did not properly validate the size of MySQL server packets in the mysqlnd driver. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218) It was discovered that PHP incorrectly handled response buffer sizes in the SOAP HTTP client. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-14181) It was discovered that PHP incorrectly handled certain TAR archive headers in the Phar extension. An attacker could possibly use this issue to inject arbitrary files into a crafted archive. (CVE-2026-6103) It was discovered that PHP did not limit recursion depth when parsing certain SOAP requests. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-91765) It was discovered that PHP incorrectly handled authentication headers when following HTTP redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-91766) It was discovered that PHP incorrectly handled wildcard names in TLS server certificates. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-91767) It was discovered that PHP incorrectly validated IPv6 client addresses in the FastCGI client access check. A remote attacker could possibly use this issue to bypass access restrictions. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-91768) It was discovered that PHP incorrectly performed TLS peer name verification. A remote attacker could possibly use this issue to impersonate a trusted server. (CVE-2026-91769) It was discovered that PHP incorrectly handled certain stream filter options. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92842) It was discovered that PHP incorrectly handled empty Location headers when following HTTP redirects. A malicious server could possibly use this issue to redirect the client to an unintended location. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-93682)