• ZendPHP April 2025 Releases

    Community changes

    PHP version 8.4.6 changes

    • BCMath

      • Fixed pointer subtraction for scale.

    • Core

      • Fixed property hook backing value access in multi-level inheritance.
      • Fixed accidentally inherited default value in overridden virtual properties.
      • Fixed bug GH-17376: Broken JIT polymorphism for property hooks added to child class.
      • Fixed bug GH-17913: ReflectionFunction::isDeprecated() returns incorrect results for closures created from magic __call().
      • Fixed bug GH-17941: Stack-use-after-return with lazy objects and hooks.
      • Fixed bug GH-17988: Incorrect handling of hooked props without get hook in get_object_vars().
      • Fixed bug GH-17998: Skipped lazy object initialization on primed SIMPLE_WRITE cache.
      • Fixed bug GH-17998: Assignment to backing value in set hook of lazy proxy calls hook again.
      • Fixed bug GH-17961: use-after-free during dl()'ed module class destruction.
      • Fixed bug GH-15367: dl() of module with aliased class crashes in shutdown.
      • Fixed OSS-Fuzz #403308724.
      • Fixed bug GH-13193 again: Significant performance degradation in foreach.

    • DBA

      • Fixed assertion violation when opening the same file with dba_open multiple times.

    • DOM

      • Fixed bug GH-17991: Assertion failure dom_attr_value_write.
      • Fix weird unpack behaviour in DOM.
      • Fixed bug GH-18090: DOM: SVG attributes and tag names are being lowercased.
      • Fix xinclude destruction of live attributes.

    • Fuzzer

      • Fixed bug GH-18081: Memory leaks in error paths of fuzzer SAPI.

    • GD

      • Fixed bug GH-17984: calls with arguments as array with references.

    • LDAP

      • Fixed bug GH-18015: Error messages for ldap_mod_replace are confusing.

    • Mbstring

      • Fixed bug GH-17989: mb_output_handler crash with unset http_output_conv_mimetypes.

    • Opcache

      • Fixed bug GH-15834: Segfault with hook "simple get" cache slot and minimal JIT.
      • Fixed bug GH-17966: Symfony JIT 1205 assertion failure.
      • Fixed bug GH-18037: SEGV Zend/zend_execute.c.
      • Fixed bug GH-18050: IN_ARRAY optimization in DFA pass is broken.
      • Fixed bug GH-18113: stack-buffer-overflow ext/opcache/jit/ir/ir_sccp.c.
      • Fixed bug GH-18112: NULL access with preloading and INI option.
      • Fixed bug GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table.

    • PDO

      • Fix memory leak when destroying PDORow.

    • PGSQL

      • Fixed bug GH-18148: pg_copy_from() regression with explicit \n terminator due to wrong offset check.

    • Standard

      • Fix memory leaks in array_any() / array_all().

    • SOAP

      • Fixed bug #66049: Typemap can break parsing in parse_packet_soap leading to a segfault.

    • SPL

      • Fixed bug GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject.

    • Treewide

      • Fixed bug GH-17736: Assertion failure zend_reference_destroy().

    • Windows

      • Fixed bug GH-17836: zend_vm_gen.php shouldn't break on Windows line endings.

    PHP version 8.3.20 changes

    • Core

      • Fixed bug GH-17961: use-after-free during dl()'ed module class destruction.
      • Fixed bug GH-15367: dl() of module with aliased class crashes in shutdown.
      • Fixed bug GH-13193 again: Significant performance degradation in foreach.

    • DOM

      • Fix weird unpack behaviour in DOM.
      • Fix xinclude destruction of live attributes.

    • Embed

      • Fixed bug GH-8533: Unable to link dynamic libphp on Mac.

    • Fuzzer

      • Fixed bug GH-18081: Memory leaks in error paths of fuzzer SAPI.

    • GD

      • Fixed bug GH-17984: calls with arguments as array with references.

    • Intl

      • Fix locale_compose and locale_lookup to work with their array argument with values as references.
      • Fix dateformat_format when the time is an array of references.
      • Fix UConverter::transcode with substitutes as references.

    • Mbstring

      • Fixed bug GH-17989: mb_output_handler crash with unset http_output_conv_mimetypes.

    • Opcache

      • Fixed bug GH-18112: NULL access with preloading and INI option.
      • Fixed bug GH-18107: Opcache CFG jmp optimization with try-finally breaks the exception table.

    • PDO

      • Fix memory leak when destroying PDORow.

    • SOAP

      • Fixed bug #66049: Typemap can break parsing in parse_packet_soap leading to a segfault.

    • SPL

      • Fixed bug GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject.

    • Treewide

      • Fixed bug GH-17736: Assertion failure zend_reference_destroy().

    • Windows

      • Fixed bug GH-17836: zend_vm_gen.php shouldn't break on Windows line endings.

  • Zend Server 2021.3.2

    Changes

    • Added Support for IBM i 7.5

    Backported PHP CVE fixes

    • PHP version 7.1.33.21, 7.2.34.17, 7.3.33.9, 7.4.33.4
      • Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
      • Phar: Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
    • PHP version 7.1.33.20, 7.2.34.16, 7.3.33.8, 7.4.33.3
      • Soap: Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)

    Bugfixes

    • PHP version 7.1.33.19, 7.2.34.15, 7.3.33.7
      • Intl: Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).

    Windows package updates

    • Apache 2.4.57

  • ZendPHP March 2025 LTS Releases

    Backported CVE Fixes for ZendPHP 8.0.30.6, 7.4.33.10, 7.3.33.16, and 7.2.34.24

    • LibXML

      • Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
      • Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong content-type header when requesting a redirected resource). (CVE-2025-1219)

    • Streams

      • Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of http stream wrapper does not handle folded headers). (CVE-2025-1217)

  • Zend Server 2021.3.1

    Backported PHP CVE fixes

    • PHP version 7.1.33.18, 7.2.34.14, 7.3.33.6, 7.4.33.2
      • Core
        • Fixed bug #81744 (Password_verify() always return true with some hash).   (CVE-2023-0567)
        • Fixed bug #81746 (1-byte array overrun in common path resolve code).   (CVE-2023-0568)
      • FPM
        • Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart   request body). (CVE-2023-0662)
    • PHP version 7.1.33.17, 7.2.34.13, 7.3.33.5, 7.4.33.1
      • PDO/SQLite: Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)

    Windows Package Updates

    • Apache 2.4.56 (adding also MS vs17 64-bit c++ redistributable installation)
    • OpenSSL 1.1.1t
    • cURL 7.88.1

  • Zend Server 2019.1.4

    Contains only PHP and installer/packaging fixes/changes; no changes in Zend Server.

    Backported PHP 7.1.33.21, 7.2.34.17, 7.3.33.9 CVE Fixes

    • Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
    • Phar: Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)

    Backported PHP 7.1.33.20, 7.2.34.16, 7.3.33.8 CVE Fixes

    • Soap: Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)

    Backported PHP 7.1.33.19, 7.2.34.15, 7.3.33.7 CVE Fixes

    • Intl: Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).

    Windows

    • Updated Apache v.2.4.57 in Zend Server Windows installation package

  • Zend Server 9.1.16

    Note: 9.1.16 is the final release version for Zend Server 9.1.

    PHP version 7.1.33.18.

    Backported CVE fixes

    • Core
      • Fixed bug #81744 (password_verify() always return true with some hashes). (CVE-2023-0567)
      • Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
    • FPM
      • Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)
    • PDO/SQLite
      • Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)

  • Zend Server 2019.1.3

    PHP fixes only.

    PHP version 7.1.33.18, 7.2.34.14, 7.3.33.6 CVE fixes

    • Core
      • Fixed bug #81744 (password_verify() always return true with some hash). (CVE-2023-0567)
      • Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
    • FPM
      • Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

    PHP version 7.1.33.17, 7.2.34.13, 7.3.33.5 CVE fixes

    • PDO/SQLite
      • Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)

  • ZendPHP May 2025 Releases

    Community Changes

    PHP Version 8.4.7 Changes

    • Core

      • Fixed bug GH-18038: Lazy proxy calls magic methods twice.
      • Fixed bug GH-18209: Use-after-free in extract() with EXTR_REFS.
      • Fixed bug GH-18268: Segfault in array_walk() on object with added property hooks.
      • Fixed bug GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault.
      • Fix some leaks in php_scandir.

    • DBA

      • Fixed bug GH-18247: dba_popen() memory leak on invalid path.

    • Filter

      • Fixed bug GH-18309: ipv6 filter integer overflow.

    • GD

      • Fixed imagecrop() overflow with rect argument with x/width y/height usage in gdImageCrop().
      • Fixed GH-18243: imagettftext() overflow/underflow on font size value.

    • Intl

      • Fix reference support for intltz_get_offset().

    • LDAP

      • Fixed bug GH-17776: LDAP_OPT_X_TLS_* options can't be overridden.
      • Fix NULL deref on high modification key.

    • libxml

      • Fixed custom external entity loader returning an invalid resource leading to a confusing TypeError message.
      • Fixed bug GH-18289: Fix segfault in JIT.
      • Fixed bug GH-18136: tracing JIT floating point register clobbering on Windows and ARM64.

    • OpenSSL

      • Fix memory leak in openssl_sign() when passing invalid algorithm.
      • Fix potential leaks when writing to BIO fails.

    • PDO Firebird

      • Fixed bug GH-18276: persistent connection - "zend_mm_heap corrupted" with setAttribute()
      • Fixed bug GH-17383: PDOException has wrong code and message since PHP 8.4

    • PDO Sqlite

      • Fix memory leak on error return of collation callback.

    • PgSql

      • Fix uouv in pg_put_copy_end().

    • SPL

      • Fixed bug GH-18322: SplObjectStorage debug handler mismanages memory.

    • Standard

      • Fixed bug GH-18145: php8ts crashes in php_clear_stat_cache().
      • Fix resource leak in iptcembed() on error.

    • Tests

      • Address deprecated PHP 8.4 session options to prevent test failures.

    • Zip

      • Fix uouv when handling empty options in ZipArchive::addGlob().
      • Fix memory leak when handling a too long path in ZipArchive::addGlob().

    PHP Version 8.3.21 Changes

    • Core

      • Fixed bug GH-18304: Changing the properties of a DateInterval through dynamic properties triggers a SegFault.
      • Fix some leaks in php_scandir.

    • Filter

      • Fixed bug GH-18309: ipv6 filter integer overflow.

    • GD

      • Fixed imagecrop() overflow with rect argument with x/width y/height usage in gdImageCrop().
      • Fixed GH-18243: imagettftext() overflow/underflow on font size value.

    • Intl

      • Fix reference support for intltz_get_offset().

    • LDAP

      • Fixed bug GH-17776: LDAP_OPT_X_TLS_* options can't be overridden.
      • Fix NULL deref on high modification key.

    • libxml

      • Fixed custom external entity loader returning an invalid resource leading to a confusing TypeError message.

    • OpenSSL

      • Fix memory leak in openssl_sign() when passing invalid algorithm.
      • Fix potential leaks when writing to BIO fails.

    • PDO Firebird

      • Fixed bug GH-18276: persistent connection - "zend_mm_heap corrupted" with setAttribute()

    • SPL

      • Fixed bug GH-18322: SplObjectStorage debug handler mismanages memory.

    • Standard

      • Fixed bug GH-18145: php8ts crashes in php_clear_stat_cache().
      • Fixed bug GH-18209: Use-after-free in extract() with EXTR_REFS.
      • Fixed bug GH-18212: fseek with SEEK_CUR whence value and negative offset leads to negative stream position.
      • Fix resource leak in iptcembed() on error.

    • Zip

      • Fix uouv when handling empty options in ZipArchive::addGlob().
      • Fix memory leak when handling a too long path in ZipArchive::addGlob().

  • Zend Server 2021.3.4

    Contains only PHP and installer/packaging fixes/changes.

    Added

    • Adds support for Rocky Linux 8 (x68_64 only)
      • ZS Repository Installer script updated to allow usage with Rocky Linux 8.

    Backported PHP CVE fixes

    • PHP version 7.1.33.22, 7.2.34.18, 7.3.33.10, 7.4.33.5 CVE fixes
      • Standard
        • Fixed bug GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)
        • Fixed bug GHSA-h746-cjrr-wfmr: password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)
    • PHP version 7.4.33.5 CVE fix
      • Standard
        • Fixed bug GHSA-pc52-254m-w9w7: Command injection via array-ish $command parameter of proc_open. (CVE-2024-1874)

    Known issues

    RHEL 8 upgrade may fail with the message:

    Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

    This problem is related to RHEL RPM package dependency resolving, and cannot be fixed in Zend Server packaging. Dependency package libaio from RHEL repository does not install for unknown reasons.

    Solution: Enter the following command when this error message has been displayed, and then retry the upgrade.

    sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend