ESLog inGet started free
High 7.2 CVSS 3.1 PHP Published on 2024-11-24

In PHP versions 8.1. before 8.1.31, 8.2.

CVECVE-2024-11234 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-06-17

Description

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security@php.net · secondary
High 7.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vectorNetwork
ComplexityHigh
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

PHP (29)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-109619 PHP has various global state that temporarily points into request memory. PHP Critical 9.2 ≥ 5.4.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No
CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. PHP Critical 9.8 ≥ 7.3.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No
CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. PHP High 7.5 ≥ 8.2.0 < 8.2.34
≥ 8.3.0 < 8.3.35
≥ 8.4.0 < 8.4.26
+1 2026-09-25 No
CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP… PHP Critical 9.8 ≥ 8.4.0 < 8.4.24
≥ 8.5.0 < 8.5.9 2026-07-30 No

Does your server run PHP 8.1.x ≥ 8.1.0 < 8.1.31, 8.2.x ≥ 8.2.0 < 8.2.26, 8.3.x ≥ 8.3.0 < 8.3.14?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected