php-src vulnerabilities
CVEs whose affected-version data names the php-src package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-109619Critical· 9.2RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
▾ MidnightPHP Group · php-srcvia CVEORG
CVE-2026-109618Critical· 9.2PoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
▾ AbyssalPHP Group · php-srcvia CVEORG