Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.4
PHP mysqlnd parser may read beyond packet data
published 10 days ago
Summary
The mysqlnd component in the PHP package can read data from a server packet before confirming the packet is large enough. This can cause the application to crash or be manipulated by an attacker. Upgrade to the latest PHP release that includes the fix, or apply the vendor's recommended patch.
What to do
- Update cleanstart php to version 8.3.35-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | php |
< 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
Original advisory text
mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them
Security vulnerability affects the php package. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published9 Oct 2026
Updated9 Oct 2026
First seen9 Oct 2026
Sources
CLEANSTART-2026-UY82629 · OSV
Track software like this
Free during beta