Riskcovery

CVE-2024-9026

PHP-FPM logs from children may be altered

State
Published
Severity
3.3 Low
Published
Oct 8, 2024
Updated
Nov 3, 2025
Reserved
Sep 20, 2024

Read the record on cve.org

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

Scores

CVSSScoreVectorSource
3.13.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nphp

Weaknesses

  • CWE-158 Improper Neutralization of Null Byte or NUL Character
  • CWE-117 Improper Output Neutralization for Logs

Affected Products

ProductVersions
PHPPHP Group
  • 8.1.* to before 8.1.30Affected
  • 8.2.* to before 8.2.24Affected
  • 8.3.* to before 8.3.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.