Denial of Service Vulnerability in PHP by The PHP Group

CVE-2026-7258

What is CVE-2026-7258?

In specific versions of PHP, vulnerabilities exist where certain functions, like urldecode(), can inadvertently pass signed char values to ctype functions, such as isxdigit(). If a system utilizes default signed char types and optimized ctype functions, particularly on platforms like NetBSD, this may result in access attempts to arrays with negative offsets, potentially leading to service disruptions.

References