CVE-2022-31628

phar wrapper can occur dos when using quine gzip file

State: Published
Severity: 2.3 Low
Published: Sep 28, 2022
Updated: May 20, 2025
Reserved: May 25, 2022

Description

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Scores

CVSS	Score	Vector	Source
3.1	2.3 Low	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	php

Weaknesses

CWE-674 Uncontrolled Recursion

Affected Products

Product	Versions
PHPPHP Group	7.4.X to before 7.4.31Affected 8.0.X to before 8.0.24Affected 8.1.X to before 8.1.11Affected

References

https://bugs.php.net/bug.php?id=81726
FEDORA-2022-0b77fbd9e7vendor-advisory
FEDORA-2022-afdea1c747vendor-advisory
FEDORA-2022-f204e1d0edvendor-advisory
DSA-5277vendor-advisory
GLSA-202211-03vendor-advisory
https://security.netapp.com/advisory/ntap-20221209-0001/
[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security updatemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.