← Back to support deadlines Find PHP vulnerability and response guides →

PHP fixed-version check

Check PHP vulnerability fixes
by provider and version

Choose a CVE and enter your PHP provider and version. Compare them with published fixed versions and identify what to check next.

Coverage: 6 CVEUpstream PHP and selected Debian packagesInput is not stored or sent

Different PHP providers can have different fixed versions

Upstream PHP

Branch and official version

OS distribution build

Provider and full revision

Compare with that provider's published fixes

Version ordering alone is not applied across all distributions

Only catalogued CVEs are compared. Missing entries do not mean unaffected. This page does not access or scan your device or site. Official links open external sites.

STEP 01

Choose a CVE to check

Catalog: 6 entriesMatches: 6 entriesThis is not a list of every PHP vulnerability

This filters the catalog on this page. After selecting a CVE, enter the provider and version to compare with published fixed versions.

2. Check the provider and full version

CVE to check

This CVE concerns PHP's MySQL connection functionality. Features, settings and connection targets are not automatically checked.

Coverage includes upstream PHP 8.1, 8.2 and 8.3, and the catalogued Debian 11 and 12 source packages.

Provider and release branchFull version number

Enter the upstream PHP version. Do not remove custom or OS package suffixes and treat the result as an upstream version.

Have you verified the provider in your management records?

The same software can have different fixed versions from different providers. Do not enter complete configurations, URLs, connection details or credentials.

The published condition is that PHP using MySQLnd processes a response from an attacker-controlled MySQL server. Ordinary MySQL use alone does not establish that this condition is met. Check the conditions in the published source ↗

Have you verified the published MySQLnd and connection conditions?

This is separate from checking the provider and version. This additional condition check covers upstream PHP 8.2.25, for which evidence is catalogued. You can leave it unverified. Reporting non-use alone does not produce a fixed-version result.

3. Comparison with this CVE's published information

Select a CVE, provider and version to compare. This does not scan your device or server. Coverage: 6 CVEs.

Coverage, fixed versions and official sources

Source check dates are shown below for each CVE, provider and branch. Features and settings are not automatically checked. For upstream PHP 8.2.25 and CVE-2024-8929, the comparison also uses your self-reported confirmation of the published conditions. Older versions with unverified conditions are shown as potentially affected. A version number alone does not establish exploitability or compromise.

CVE-2024-8929: Memory read in MySQL connection functionality5 provider/branch records · Open official sources

This CVE concerns PHP's MySQL connection functionality. Features, settings and connection targets are not automatically checked.

Coverage includes upstream PHP 8.1, 8.2 and 8.3, and the catalogued Debian 11 and 12 source packages.

Upstream PHP (php.net), branch 8.2

Source checked: 2026-10-16

First fixed version: 8.2.26

Highest catalogued version: 8.2.34

Catalogued versions at or above the fix: 8.2.26, 8.2.27, 8.2.28, 8.2.29, 8.2.30, 8.2.31, 8.2.32, 8.2.33, 8.2.34

Scope: upstream PHP 8.2. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.2.26 ↗

Upstream PHP (php.net), branch 8.3

Source checked: 2026-10-18

First fixed version: 8.3.14

Highest catalogued version: 8.3.35

Catalogued versions at or above the fix: 8.3.14, 8.3.15, 8.3.16, 8.3.17, 8.3.19, 8.3.20, 8.3.21, 8.3.22, 8.3.23, 8.3.24, 8.3.25, 8.3.26, 8.3.27, 8.3.28, 8.3.29, 8.3.30, 8.3.31, 8.3.32, 8.3.33, 8.3.35

Scope: upstream PHP 8.3. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.3.14 ↗PHP: historical releases ↗PHP: changelog for 8.3.35 ↗

Upstream PHP (php.net), branch 8.1 — upstream support ended

Source checked: 2026-10-18

First fixed version: 8.1.31

Highest catalogued version: 8.1.34

Catalogued versions at or above the fix: 8.1.31, 8.1.32, 8.1.33, 8.1.34

Scope: upstream PHP 8.1. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.1.31 ↗PHP: historical releases ↗PHP: unsupported branches and final releases ↗

Official Debian 11 bullseye, php7.4

Source checked: 2026-10-16

First fixed version: 7.4.33-1+deb11u7

Highest catalogued version: 7.4.33-1+deb11u7

Catalogued versions at or above the fix: 7.4.33-1+deb11u7

Scope: source package php7.4 from the official provider (bullseye). Third-party repositories, other operating systems and custom builds are excluded.

Debian: CVE-2024-8929 fixes and affected packages ↗Debian: DLA-3986-1 ↗

Official Debian 12 bookworm, php8.2

Source checked: 2026-10-16

First fixed version: 8.2.26-1~deb12u1

Highest catalogued version: 8.2.34-1~deb12u1

Catalogued versions at or above the fix: 8.2.26-1~deb12u1, 8.2.32-1~deb12u1, 8.2.34-1~deb12u1

Scope: source package php8.2 from the official provider (bookworm). Third-party repositories, other operating systems and custom builds are excluded.

Debian: CVE-2024-8929 fixes and affected packages ↗Debian: DSA-5819-1 ↗

CVE-2025-1219: Character encoding detection for DOM/SimpleXML HTTP retrieval6 provider/branch records · Open official sources

This CVE concerns the Content-Type used for character encoding detection when DOM/SimpleXML retrieves an HTTP resource that redirects. Feature use, destinations and settings are not automatically checked.

Coverage includes upstream PHP 8.1, 8.2, 8.3 and 8.4, and the catalogued Debian 11 and 12 source packages. Other OS builds, third-party distributions and custom builds are not catalogued. Missing coverage does not mean unaffected.

Upstream PHP (php.net), branch 8.2

Source checked: 2026-10-18

First fixed version: 8.2.28

Highest catalogued version: 8.2.34

Catalogued versions at or above the fix: 8.2.28, 8.2.29, 8.2.30, 8.2.31, 8.2.32, 8.2.33, 8.2.34

Scope: upstream PHP 8.2. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.2.28 ↗PHP: changelog for 8.2.34 ↗CVE record: CVE-2025-1219 scope and conditions ↗

Upstream PHP (php.net), branch 8.3

Source checked: 2026-10-18

First fixed version: 8.3.19

Highest catalogued version: 8.3.35

Catalogued versions at or above the fix: 8.3.19, 8.3.20, 8.3.21, 8.3.22, 8.3.23, 8.3.24, 8.3.25, 8.3.26, 8.3.27, 8.3.28, 8.3.29, 8.3.30, 8.3.31, 8.3.32, 8.3.33, 8.3.35

Scope: upstream PHP 8.3. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.3.19 ↗PHP: changelog for 8.3.35 ↗CVE record: CVE-2025-1219 scope and conditions ↗

Upstream PHP (php.net), branch 8.1 — upstream support ended

Source checked: 2026-10-18

First fixed version: 8.1.32

Highest catalogued version: 8.1.34

Catalogued versions at or above the fix: 8.1.32, 8.1.33, 8.1.34

Scope: upstream PHP 8.1. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.1.32 ↗PHP: changelog for 8.1.34 ↗CVE record: CVE-2025-1219 scope and conditions ↗PHP: unsupported branches and final releases ↗

Upstream PHP (php.net), branch 8.4

Source checked: 2026-10-18

First fixed version: 8.4.5

Highest catalogued version: 8.4.26

Catalogued versions at or above the fix: 8.4.5, 8.4.6, 8.4.7, 8.4.8, 8.4.10, 8.4.11, 8.4.12, 8.4.13, 8.4.14, 8.4.15, 8.4.16, 8.4.17, 8.4.18, 8.4.19, 8.4.20, 8.4.21, 8.4.22, 8.4.23, 8.4.24, 8.4.25, 8.4.26

Scope: upstream PHP 8.4. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: fix history for 8.4.5 ↗PHP: changelog for 8.4.26 ↗CVE record: CVE-2025-1219 scope and conditions ↗

Official Debian 11 bullseye, php7.4

Source checked: 2026-10-18

First fixed version: 7.4.33-1+deb11u8

Highest catalogued version: 7.4.33-1+deb11u8

Catalogued versions at or above the fix: 7.4.33-1+deb11u8

Scope: source package php7.4 from the official provider (bullseye). Third-party repositories, other operating systems and custom builds are excluded.

Debian: fixed source packages for CVE-2025-1219 ↗Debian: DLA-4088-1 ↗

Official Debian 12 bookworm, php8.2

Source checked: 2026-10-18

First fixed version: 8.2.28-1~deb12u1

Highest catalogued version: 8.2.34-1~deb12u1

Catalogued versions at or above the fix: 8.2.28-1~deb12u1, 8.2.32-1~deb12u1, 8.2.34-1~deb12u1

Scope: source package php8.2 from the official provider (bookworm). Third-party repositories, other operating systems and custom builds are excluded.

Debian: fixed source packages for CVE-2025-1219 ↗Debian: DSA-5878-1 ↗

CVE-2024-11233: Memory read in a string conversion filter3 provider/branch records · Open official sources

This CVE concerns processing in the convert.quoted-printable-decode filter. Filter use and input conditions are not automatically checked.

Coverage includes upstream PHP 8.1, 8.2 and 8.3. Fixes for OS builds such as Debian, third-party distributions and custom builds are not catalogued.

Upstream PHP (php.net), branch 8.2

Source checked: 2026-10-20

First fixed version: 8.2.26

Highest catalogued version: 8.2.34

Catalogued versions at or above the fix: 8.2.26, 8.2.27, 8.2.28, 8.2.29, 8.2.30, 8.2.31, 8.2.32, 8.2.33, 8.2.34

Scope: upstream PHP 8.2. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2024-11233 ↗PHP: fix history for 8.2.26 ↗PHP: changelog for 8.2.34 ↗CVE record: CVE-2024-11233 scope and conditions ↗

Upstream PHP (php.net), branch 8.3

Source checked: 2026-10-20

First fixed version: 8.3.14

Highest catalogued version: 8.3.35

Catalogued versions at or above the fix: 8.3.14, 8.3.15, 8.3.16, 8.3.17, 8.3.19, 8.3.20, 8.3.21, 8.3.22, 8.3.23, 8.3.24, 8.3.25, 8.3.26, 8.3.27, 8.3.28, 8.3.29, 8.3.30, 8.3.31, 8.3.32, 8.3.33, 8.3.35

Scope: upstream PHP 8.3. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2024-11233 ↗PHP: fix history for 8.3.14 ↗PHP: changelog for 8.3.35 ↗CVE record: CVE-2024-11233 scope and conditions ↗

Upstream PHP (php.net), branch 8.1 — upstream support ended

Source checked: 2026-10-20

First fixed version: 8.1.31

Highest catalogued version: 8.1.34

Catalogued versions at or above the fix: 8.1.31, 8.1.32, 8.1.33, 8.1.34

Scope: upstream PHP 8.1. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2024-11233 ↗PHP: fix history for 8.1.31 ↗PHP: changelog for 8.1.34 ↗CVE record: CVE-2024-11233 scope and conditions ↗

CVE-2024-4577: Argument handling in PHP-CGI on Windows3 provider/branch records · Open official sources

This CVE concerns published conditions involving Apache and PHP-CGI on Windows with particular character encoding settings. OS, execution mode and settings are not automatically detected. Version numbers alone do not establish exploitability or compromise.

This compares published fix boundaries for upstream PHP 8.1, 8.2 and 8.3. It does not assess the impact on other execution modes or providers. Fixes in OS distribution builds are not catalogued.

Upstream PHP (php.net), branch 8.2

Source checked: 2026-10-20

First fixed version: 8.2.20

Highest catalogued version: 8.2.34

Catalogued versions at or above the fix: 8.2.20, 8.2.21, 8.2.22, 8.2.23, 8.2.24, 8.2.25, 8.2.26, 8.2.27, 8.2.28, 8.2.29, 8.2.30, 8.2.31, 8.2.32, 8.2.33, 8.2.34

Scope: upstream PHP 8.2. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2024-4577 ↗PHP: fix history for 8.2.20 ↗PHP: changelog for 8.2.34 ↗CVE record: CVE-2024-4577 scope and conditions ↗

Upstream PHP (php.net), branch 8.3

Source checked: 2026-10-20

First fixed version: 8.3.8

Highest catalogued version: 8.3.35

Catalogued versions at or above the fix: 8.3.8, 8.3.9, 8.3.10, 8.3.11, 8.3.12, 8.3.13, 8.3.14, 8.3.15, 8.3.16, 8.3.17, 8.3.19, 8.3.20, 8.3.21, 8.3.22, 8.3.23, 8.3.24, 8.3.25, 8.3.26, 8.3.27, 8.3.28, 8.3.29, 8.3.30, 8.3.31, 8.3.32, 8.3.33, 8.3.35

Scope: upstream PHP 8.3. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2024-4577 ↗PHP: fix history for 8.3.8 ↗PHP: changelog for 8.3.35 ↗CVE record: CVE-2024-4577 scope and conditions ↗

Upstream PHP (php.net), branch 8.1 — upstream support ended

Source checked: 2026-10-20

First fixed version: 8.1.29

Highest catalogued version: 8.1.34

Catalogued versions at or above the fix: 8.1.29, 8.1.30, 8.1.31, 8.1.32, 8.1.33, 8.1.34

Scope: upstream PHP 8.1. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2024-4577 ↗PHP: fix history for 8.1.29 ↗PHP: changelog for 8.1.34 ↗CVE record: CVE-2024-4577 scope and conditions ↗

CVE-2025-1734: HTTP response header handling4 provider/branch records · Open official sources

This CVE concerns response header processing in PHP's HTTP stream wrapper. HTTP retrieval use, input and destination conditions are not automatically checked.

Upstream PHP 8.1, 8.2, 8.3 and 8.4 are catalogued. Version 8.3.18 remains unverified because official sources differ in scope. OS builds, third-party distributions and custom builds are not catalogued.

Upstream PHP (php.net), branch 8.2

Source checked: 2026-10-20

First fixed version: 8.2.28

Highest catalogued version: 8.2.34

Catalogued versions at or above the fix: 8.2.28, 8.2.29, 8.2.30, 8.2.31, 8.2.32, 8.2.33, 8.2.34

Scope: upstream PHP 8.2. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2025-1734 ↗PHP: fix history for 8.2.28 ↗PHP: changelog for 8.2.34 ↗CVE record: CVE-2025-1734 scope and conditions ↗

Upstream PHP (php.net), branch 8.3

Source checked: 2026-10-20

First fixed version: 8.3.19

Highest catalogued version: 8.3.35

Catalogued versions at or above the fix: 8.3.19, 8.3.20, 8.3.21, 8.3.22, 8.3.23, 8.3.24, 8.3.25, 8.3.26, 8.3.27, 8.3.28, 8.3.29, 8.3.30, 8.3.31, 8.3.32, 8.3.33, 8.3.35

Scope: upstream PHP 8.3. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2025-1734 ↗PHP: fix history for 8.3.19 ↗PHP: changelog for 8.3.35 ↗CVE record: CVE-2025-1734 scope and conditions ↗

Upstream PHP (php.net), branch 8.1 — upstream support ended

Source checked: 2026-10-20

First fixed version: 8.1.32

Highest catalogued version: 8.1.34

Catalogued versions at or above the fix: 8.1.32, 8.1.33, 8.1.34

Scope: upstream PHP 8.1. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2025-1734 ↗PHP: fix history for 8.1.32 ↗PHP: changelog for 8.1.34 ↗CVE record: CVE-2025-1734 scope and conditions ↗

Upstream PHP (php.net), branch 8.4

Source checked: 2026-10-20

First fixed version: 8.4.5

Highest catalogued version: 8.4.26

Scope: upstream PHP 8.4. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2025-1734 ↗PHP: fix history for 8.4.5 ↗PHP: changelog for 8.4.26 ↗CVE record: CVE-2025-1734 scope and conditions ↗

CVE-2026-91768: IPv6 client restrictions in PHP-FPM4 provider/branch records · Open official sources

This CVE concerns PHP-FPM using FastCGI over IPv6 TCP with listen.allowed_clients used to restrict clients. Execution mode, network path and settings are not automatically checked. A version comparison alone does not determine impact on your environment or compromise.

Published fixed versions for upstream PHP 8.2, 8.3, 8.4 and 8.5 are catalogued. OS builds, third-party distributions and custom builds are not included. Unlisted versions are not treated as unaffected.

Upstream PHP (php.net), branch 8.2

Source checked: 2026-10-20

First fixed version: 8.2.34

Highest catalogued version: 8.2.34

Catalogued versions at or above the fix: 8.2.34

Scope: upstream PHP 8.2. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2026-91768 ↗PHP: fix history for 8.2.34 ↗

Upstream PHP (php.net), branch 8.3

Source checked: 2026-10-20

First fixed version: 8.3.35

Highest catalogued version: 8.3.35

Catalogued versions at or above the fix: 8.3.35

Scope: upstream PHP 8.3. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2026-91768 ↗PHP: fix history for 8.3.35 ↗

Upstream PHP (php.net), branch 8.4

Source checked: 2026-10-20

First fixed version: 8.4.26

Highest catalogued version: 8.4.26

Catalogued versions at or above the fix: 8.4.26

Scope: upstream PHP 8.4. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2026-91768 ↗PHP: fix history for 8.4.26 ↗

Upstream PHP (php.net), branch 8.5

Source checked: 2026-10-20

First fixed version: 8.5.11

Highest catalogued version: 8.5.11

Catalogued versions at or above the fix: 8.5.11

Scope: upstream PHP 8.5. Versions beyond the catalogued limit are left undetermined, not labelled unfixed.

PHP: security advisory for CVE-2026-91768 ↗PHP: fix history for 8.5.11 ↗

A published fixed version addressed this CVE at that time. It does not imply a current installation recommendation or continuing OS support. Even above the fix boundary, full versions not explicitly catalogued remain undetermined. Unlisted versions, unknown providers and sources checked more than 30 days ago require official re-verification.

For upstream PHP, this compares fix boundaries in the changelog with official releases in the same branch. It does not involve running each distribution or inspecting source diffs for every later release.

The comparison date uses your device clock converted to Japan time. If the clock is inaccurate, check the displayed date and official updates.

Debian: why upstream version numbers alone do not establish fix status ↗