VDB

CVE-2026-7258

CVE-2026-7258 PUBLISHED CVSS 6.300000190734863 MEDIUM

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

EPSS 0.02% · 6.7th percentile

Risk Scores

CVSS v4.0
6.300000190734863
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/U:Amber
EPSS Score
0.02%
6.7th percentile

Affected Products

VendorProductVersions
PHP GroupPHP8.2.*, 8.4.*, 8.5.*

Timeline

  • May 8, 2026 PoC Published
  • May 8, 2026 PoC Published
  • May 10, 2026 EPSS Score
  • May 10, 2026 CVE Published
  • May 11, 2026 Security Advisory
  • May 11, 2026 CVE Updated
  • May 18, 2026 EPSS Score
  • May 19, 2026 EPSS Score
  • May 20, 2026 EPSS Score
  • May 21, 2026 EPSS Score
  • May 22, 2026 EPSS Score
  • May 23, 2026 EPSS Score
Open in Interactive Console →
$ Console Community · 100/wk Open console ›