VULNERABILITY INTELLIGENCE
CVE-2022-31625
CVSS score8.1 HIGH
EPSS probability3.79%
CISA KEVNot currently listed
Published2022-06-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
Weakness classification
- security@php.net: CWE-590
- nvd@nist.gov: CWE-763
Primary references
- security@php.net — Exploit, Issue Tracking, Mailing List, Patch, Vendor Advisory
- security@php.net — Mailing List, Third Party Advisory
- security@php.net
- security@php.net
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Mailing List, Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory