CVE-2026-17544-PoC

CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds Write Stack Smashing CVSS 9.8 Critical · CWE-787 · GHSA-x692-q9x7-8c3f Summary bcstr2num in ext/bcmath/libbcmath/src/str2num.c vendored libbcmath, PHP 8.4+ contains an off-by-N out-of-bounds write. When the user-supplied scale is smaller than the...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1667)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261667 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1668)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261668 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1715)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261715 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1716)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261716 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3302)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3302 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory i...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1659)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261659 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2026-109619, CVE-2026-109618. Tenable has extracted the...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1658)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261658 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 4 CVEs: CVE-2026-109619, CVE-2026-7568, CVE-2026-109618,...

Rocky Linux 9.2 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1654)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261654 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.2. It addresses 27 CVEs: CVE-2024-8925, CVE-2025-1217, CVE-2025-14177, CVE-2012-238...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1608)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261608 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 13 CVEs: CVE-2012-2386, CVE-2013-4248, CVE-2013-4113, CVE-2012-2329...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3162)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3162 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

CVE-2026-17544-PoC

CVE-2026-17544 — PHP bcmath bccomp Out-of-Bounds-Write Stack-Smashing CVSS 9.8 Kritisch · CWE-787 · GHSA-x692-q9x7-8c3f Zusammenfassung bcstr2num in ext/bcmath/libbcmath/src/str2num.c mitgeliefertes libbcmath, PHP 8.4+ enthält einen Off-by-N-Out-of-Bounds-Write. Wenn die vom Benutzer angegebene...

CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (ciqsa-2026_1592)

The CentOS Linux 7.9 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261592 advisory. This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2024-8927. Tenable has extracted the preceding...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791395301)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791395301 advisory. - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes fo...

Rocky Linux 9.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1587)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261587 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 9.6. It addresses 28 CVEs: CVE-2024-8925, CVE-2025-1217, CVE-2012-2386, CVE-2024-1123...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2025:1756483990)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1756483990 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Fedora 44 : php (2026-5f0023de35)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5f0023de35 advisory. PHP version 8.5.11 24 Sep 2026 BCMath: Fixed out-of-bounds read in bciszeroforscale when scale exceeds nscale. Ilia Alshanetsky Core: Fixed...

Rocky Linux 10.0 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_7489)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257489 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth heade...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (ciqsa-2026_0138)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260138 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-36193, CVE-2020-28949. Tenable has extracted the...

Fedora 43 : php (2026-d5e4829deb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d5e4829deb advisory. PHP version 8.4.26 24 Sep 2026 BCMath: Fixed out-of-bounds read in bciszeroforscale when scale exceeds nscale. Ilia Alshanetsky Core: Fixed...