CLSA-2026-1785846081 php: Fix of CVE-2026-17543

CVE-2026-17543: fix SQL injection in ext/pgsql by dropping the E prefix in phppgsqladdquotes GHSA-7qpv-r5mr-78m4...

CLSA-2026-1785563367 php: Fix of 2 CVEs

CVE-2026-17543: fix SQL injection in ext-pgsql via E'...' backslash breakout GHSA-7qpv-r5mr-78m4 - CVE-2026-7260: fix unbounded recursion on circular phar symlinks GHSA-vc5h-9ppw-p5f3...

CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17543

CVE-2026-17543 affects PHP with ext-pgsql, where improper escaping of backslashes in attacker-provided parameters enables SQL injection via E'...' backslash breakout. Vulnerable PHP versions: 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. Affected component...

Internet Bug Bounty: Heap overflow due to integer overflow in pg_escape_string() function

The fix for this bug has been committed: https://bugs.php.net/bug.php?id=73399 Description: ------------ I have found some vulnerable code at pgescapestring function in module PostgreSQL. pgescapestring function creates a new zendstring object to store escaped string. The size of destination stri...