Search results

FFI offset CData holds dangling pointer after base object GC

Bug

Status: Needs Triage

Status: Open.

#22064 In php/php-src;

· therealcoiffeur opened on May 16, 2026

Stream filter chain UAF via self-removal during callback

Bug

Status: Needs Triage

Status: Open.

#22063 In php/php-src;

· therealcoiffeur opened on May 16, 2026

SplDoublyLinkedList iterator UAF via destructor releasing next node

Bug

Extension: spl

Status: Verified

Status: Open.

#22062 In php/php-src;

· therealcoiffeur opened on May 16, 2026

Double free via re-entrant destructor in zend_hash_clean() (Double Free)

Bug

Status: Needs Triage

Status: Open.

#22061 In php/php-src;

· therealcoiffeur opened on May 16, 2026

Class autoloader $this freed via spl_autoload_unregister during dispatch (exploitable UAF)

Bug

Status: Needs Triage

Status: Open.

#22060 In php/php-src;

· therealcoiffeur opened on May 16, 2026

Unserializing enums despite allowed_classes => false

Bug

Status: Needs Triage

Status: Open.

#22059 In php/php-src;

· edorian opened on May 16, 2026

ext/intl: PHP appears to under-expose Spoofchecker functionality on ICU 57.x

Bug

Extension: intl

Status: Needs Triage

Status: Open.

#22053 In php/php-src;

· LamentXU123 opened on May 15, 2026

Inconsistent/missing checks for sqlite3 APIs

Bug

Extension: sqlite3

Status: Needs Triage

Status: Open.

#22051 In php/php-src;

· ndossche opened on May 15, 2026

feature: overload operator

Feature

Status: Needs Triage

Status: Open.

#22050 In php/php-src;

· jobs-git opened on May 15, 2026

The unserialize function with ArrayIterator leads to NULL pointer dereference when object cloned

Bug

Category: Serialization

Extension: spl

Status: Verified

Status: Open.

#22049 In php/php-src;

· 012git012 opened on May 15, 2026

The unserialize function with ArrayObject leads to NULL pointer dereference

Bug

Category: Serialization

Extension: spl

Status: Verified

Status: Open.

#22047 In php/php-src;

· 012git012 opened on May 15, 2026

The unserialize function with Uri\WhatWg\Url leads to NULL pointer dereference when object serialized back

Bug

Category: Serialization

Extension: uri

Status: Verified

Status: Open.

#22046 In php/php-src;

· 012git012 opened on May 15, 2026