CVE-2022-31626
Highphp7.3 - security update
Published Aug 9, 2022 · Updated Sep 8, 2026 · Also known as BIT-libphp-2022-31626, BIT-php-2022-31626, BIT-php-min-2022-31626, DEBIAN-CVE-2022-31626, UBUNTU-CVE-2022-31626
Key Facts
Patch immediately- CVE-2022-31626 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting php (arch), php7 (alpine), php81 (alpine) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 58% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache2-mod_php7 7.2.34-150000.4.103.1, apache2-mod_php7 7.2.5-150000.4.95.1, apache2-mod_php7 7.4.25-150400.4.8.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
58%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-31626 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
Affected Products
1,629 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| phparch | >= 7.4.0 | 8.1.7-1 |
| php7alpine | See advisory | 7.4.32-r0 |
| php81alpine | See advisory | 8.1.7-r0 |
| php8alpine | See advisory | 8.0.24-r0 |
| libphpbitnami | >= 7.4.0 | 7.4.30 |
Patched Releases
apache2-mod_php7
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
apache2-mod_php72
7.2.5-1.81.1
apache2-mod_php74
7.4.33-1.47.2, 7.4.6-1.42.1
apache2-mod_php8
8.0.10-150400.4.8.1
apcu-panel
5.1.18-1.module+el8.3.0+7685+72d70b58, 5.1.20-1.module+el8.6.0+20568+84712317
libphp
7.4.30, 8.0.20, 8.1.7
libzip
1.6.1-1.module+el8.3.0+7685+72d70b58, 1.6.1-1.module+el8.6.0+789+2130c178, 1.7.3-1.module_el8.6.0+2739+efabdb8f, 1.7.3-1.module+el8.6.0+20568+84712317, 1.7.3-1.module+el8.6.0+790+fc63e43f
libzip-devel
1.6.1-1.module+el8.3.0+7685+72d70b58, 1.7.3-1.module+el8.6.0+20568+84712317
libzip-tools
1.6.1-1.module+el8.3.0+7685+72d70b58, 1.7.3-1.module+el8.6.0+20568+84712317
php
0:8.0.13-2.el9_0, 7.4.19-3.module+el8.6.0+20697+59319e67, 7.4.19-3.module+el8.6.0+990+389ef54a, 7.4.30, 8.0.13-2.el9_0, 8.0.13-3.module+el8.6.0+20694+4397942f, 8.0.13-3.module+el8.6.0+989+3fbff15c, 8.0.20, 8.1.7, 8.1.7-1
php:7.4
8060020220622080643.5caa48ff
php7
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.32-r0, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-bcmath
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-bz2
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-calendar
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-cli
7.4.25-150400.4.8.1, 7.4.33-150400.4.13.1
php7-ctype
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-curl
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-dba
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-devel
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-dom
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-embed
7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-enchant
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-exif
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
php7-fastcgi
7.2.34-150000.4.103.1, 7.2.5-150000.4.95.1, 7.4.25-150400.4.8.1, 7.4.33-150200.3.46.2, 7.4.33-150400.4.13.1, 7.4.6-150200.3.41.1
Timeline
Publicly disclosed
Aug 9, 2022
Last updated
Sep 8, 2026
Weakness Type
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
References
- advisoryhttp://access.redhat.com/errata/RHSA-2022:5469
- advisoryhttp://access.redhat.com/errata/RHSA-2022:5470
- advisoryhttp://access.redhat.com/errata/RHSA-2022:5478
- advisoryRHSA-2022:5467
- advisoryRHSA-2022:5468
FAQ
Common Questions.
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code…
Affected: php (arch) versions >= 7.4.0; php7 (alpine); php81 (alpine), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apache2-mod_php7 7.2.34-150000.4.103.1, apache2-mod_php7 7.2.5-150000.4.95.1, apache2-mod_php7 7.4.25-150400.4.8.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-31626 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo