{"schema_version":"2","view":"grouped","data":[{"id":60458,"cve_ids":["CVE-2026-17545"],"payload":{"kind":"advisory","title":"PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS","summary":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.","evidence":"cve:CVE-2026-17545","products":[{"name":{"value":"PHP","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-17545","aliases":["CVE-2026-17545"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"PHP Group","product":"PHP","versions":[{"status":"affected","version":"8.2.*","lessThan":"8.2.34","versionType":"semver"},{"status":"affected","version":"8.3.*","lessThan":"8.3.35","versionType":"semver"},{"status":"affected","version":"8.4.*","lessThan":"8.4.26","versionType":"semver"},{"status":"affected","version":"8.5.*","lessThan":"8.5.11","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-25T20:43:34.157Z","provider":"cve","references":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17545","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:43:10.043800Z"}}}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:43:34.157Z"}}],"cna":{"orgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","shortName":"php","dateUpdated":"2026-09-25T20:18:11.288Z"}}},"related_cves":[{"value":"CVE-2026-17545","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ba64ecc1-cbed-4d50-833c-78a15fca15c1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"libphp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libphp-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"php","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-php-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"php-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-php-min-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":4,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","advisory_id":"ba64ecc1-cbed-4d50-833c-78a15fca15c1","event_types":["advisory"],"published_at":"2026-10-25T18:34:06.226154+00:00","technologies":["core-cve","php"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T20:18:11.288+00:00","detail_url":"/advisories/advisory%3Aba64ecc1-cbed-4d50-833c-78a15fca15c1","group":{"id":"advisory:ba64ecc1-cbed-4d50-833c-78a15fca15c1","revision":1,"primary_event_id":59679,"change":"published","superseded_by":[],"changed":{"id":59679,"cve_ids":["CVE-2026-17545"],"payload":{"kind":"advisory","title":"PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS","summary":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.","evidence":"cve:CVE-2026-17545","products":[{"name":{"value":"PHP","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-17545","aliases":["CVE-2026-17545"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"PHP Group","product":"PHP","versions":[{"status":"affected","version":"8.2.*","lessThan":"8.2.34","versionType":"semver"},{"status":"affected","version":"8.3.*","lessThan":"8.3.35","versionType":"semver"},{"status":"affected","version":"8.4.*","lessThan":"8.4.26","versionType":"semver"},{"status":"affected","version":"8.5.*","lessThan":"8.5.11","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-25T20:43:34.157Z","provider":"cve","references":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17545","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:43:10.043800Z"}}}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:43:34.157Z"}}],"cna":{"orgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","shortName":"php","dateUpdated":"2026-09-25T20:18:11.288Z"}}},"related_cves":[{"value":"CVE-2026-17545","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ba64ecc1-cbed-4d50-833c-78a15fca15c1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"libphp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libphp-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"php","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-php-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"php-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-php-min-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":4,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","advisory_id":"ba64ecc1-cbed-4d50-833c-78a15fca15c1","event_types":["advisory"],"published_at":"2026-10-25T18:34:06.226154+00:00","technologies":["core-cve","php"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T20:18:11.288+00:00","detail_url":"/events/59679"},"members":[{"id":59679,"cve_ids":["CVE-2026-17545"],"payload":{"kind":"advisory","title":"PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS","summary":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.","evidence":"cve:CVE-2026-17545","products":[{"name":{"value":"PHP","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-17545","aliases":["CVE-2026-17545"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"PHP Group","product":"PHP","versions":[{"status":"affected","version":"8.2.*","lessThan":"8.2.34","versionType":"semver"},{"status":"affected","version":"8.3.*","lessThan":"8.3.35","versionType":"semver"},{"status":"affected","version":"8.4.*","lessThan":"8.4.26","versionType":"semver"},{"status":"affected","version":"8.5.*","lessThan":"8.5.11","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-25T20:43:34.157Z","provider":"cve","references":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-17545","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:43:10.043800Z"}}}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:43:34.157Z"}}],"cna":{"orgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","shortName":"php","dateUpdated":"2026-09-25T20:18:11.288Z"}}},"related_cves":[{"value":"CVE-2026-17545","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ba64ecc1-cbed-4d50-833c-78a15fca15c1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"libphp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libphp-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"php","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-php-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-17545","metrics":[],"products":[{"name":{"value":"php-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.34","evidence":"/affected/0/ranges"},{"value":"8.3.35","evidence":"/affected/0/ranges"},{"value":"8.4.26","evidence":"/affected/0/ranges"},{"value":"8.5.11","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-php-min-2026-17545","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":4,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","advisory_id":"ba64ecc1-cbed-4d50-833c-78a15fca15c1","event_types":["advisory"],"published_at":"2026-10-25T18:34:06.226154+00:00","technologies":["core-cve","php"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T20:18:11.288+00:00","detail_url":"/events/59679"}]}}],"next_after":60458,"next_before":60458}