Description
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
References (7)
Scores
CVSS v3
8.1
EPSS
0.0077
EPSS Percentile
73.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-590
CWE-763
CWE-824
Status
published
Products (3)
debian/debian_linux
10.0
debian/debian_linux
11.0
php/php
7.4.0 - 7.4.30
Published
Jun 16, 2022
Tracked Since
Feb 18, 2026