{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17545", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-07-27T10:15:15.310Z", "datePublished": "2026-09-25T20:18:11.288Z", "dateUpdated": "2026-09-25T20:43:34.157Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-09-25T20:18:11.288Z"}, "title": "PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-67", "description": "CWE-67 Improper handling of windows device names", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as <code>CON</code>, <code>PRN</code>, <code>AUX</code>, <code>NUL</code>, <code>COM1</code> to <code>COM9</code>, <code>LPT1</code> to <code>LPT9</code>, <code>CONIN$</code> and <code>CONOUT$</code> when they appear as a component of a path. An attacker-controlled filename therefore reaches <code>CreateFileW()</code> and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.</p>"}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H"}}], "credits": [{"lang": "en", "value": "@Crispr (GitHub)", "type": "reporter"}, {"lang": "en", "value": "@OSTIF-Derek", "type": "reporter"}, {"lang": "en", "value": "Shivam Mathur", "type": "remediation developer"}, {"lang": "en", "value": "Jakub Zelenka", "type": "remediation reviewer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T20:43:10.043800Z", "id": "CVE-2026-17545", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T20:43:34.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17545", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T20:43:10.043800Z"}}}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T20:43:29.843Z"}}], "cna": {"title": "PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "@Crispr (GitHub)"}, {"lang": "en", "type": "reporter", "value": "@OSTIF-Derek"}, {"lang": "en", "type": "remediation developer", "value": "Shivam Mathur"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Zelenka"}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.", "supportingMedia": [{"type": "text/html", "value": "<p>On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as <code>CON</code>, <code>PRN</code>, <code>AUX</code>, <code>NUL</code>, <code>COM1</code> to <code>COM9</code>, <code>LPT1</code> to <code>LPT9</code>, <code>CONIN$</code> and <code>CONOUT$</code> when they appear as a component of a path. An attacker-controlled filename therefore reaches <code>CreateFileW()</code> and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-67", "description": "CWE-67 Improper handling of windows device names"}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-09-25T20:18:11.288Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17545", "state": "PUBLISHED", "dateUpdated": "2026-09-25T20:43:34.157Z", "dateReserved": "2026-07-27T10:15:15.310Z", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "datePublished": "2026-09-25T20:18:11.288Z", "assignerShortName": "php"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.2.34", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.35", "status": "affected", "version": "8.3.*", "versionType": "semver"}, {"lessThan": "8.4.26", "status": "affected", "version": "8.4.*", "versionType": "semver"}, {"lessThan": "8.5.11", "status": "affected", "version": "8.5.*", "versionType": "semver"}]}], "source": "security@php.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "AAFB3643-4D71-46ED-8184-DDE5FE41CD02", "versionEndExcluding": "8.2.34", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF664EE8-D417-45A4-84DF-158F5073FDE8", "versionEndExcluding": "8.3.35", "versionStartIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "52D4BECA-EF0D-4180-837C-AEFA7A12D243", "versionEndExcluding": "8.4.26", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "308803C0-9FC8-40D2-8920-B83BCC48014F", "versionEndExcluding": "8.5.11", "versionStartIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}], "id": "CVE-2026-17545", "lastModified": "2026-10-23T14:43:15.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@php.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17545", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T20:43:10.043800Z", "version": "2.0.3"}}]}, "published": "2026-09-25T21:17:23.253", "references": [{"source": "security@php.net", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-67"}], "source": "security@php.net", "type": "Secondary"}]}

{"bugzilla": {"description": "php: PHP: Denial of Service via reserved device names on Windows", "id": "2541645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541645"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-66", "details": ["A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This can cause application worker processes to block or hang indefinitely, resulting in a Denial of Service (DoS) through resource exhaustion."], "name": "CVE-2026-17545", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php8.4", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:7.4/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.3/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.4/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "php", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-25T20:18:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-17545\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17545\nhttps://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"], "threat_severity": "Moderate"}