CVE-2026-12184

TLS Cleanup Crash

Publication Date 2026-07-03
Severity High
Type Denial of Service
Affected PHP Versions
  • 8.3.0-8.3.31
  • 8.4.0-8.4.20
  • 8.5.0-8.5.5
Fixed Product Versions
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5

CVE Details

When an HTTPS stream fails its TLS setup, PHP closes the stream and sets it to NULL. However, the next cleanup step still tries to reset the peer name on that dead stream. The result is that an expired or invalid certificate can cause the PHP script to crash.

Recommendations

If you are calling web services behind TLS using PHP's stream API, you have the following options:

  • Update to a patched version of PHP
  • Use a different mechanism to call the web service (e.g., ext-curl)