Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.4 » 8.4.25 »

PHP 8.4.16

The latest release of PHP 8.4 is 8.4.25 which includes important security patches.

Source Code

Change Log

  • core

    • Sync all boost.context files with release 1.86.0.
      mvorisek
    • Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument passing to variadic parameter).
      ndossche
    • Fixed bug GH-20286 (use-after-destroy during userland stream_close()).
      ndossche
      David Carlier

  • bz2

    • Fix assertion failures resulting in crashes with stream filter object parameters.
      ndossche

  • date

    • Fix crashes when trying to instantiate uninstantiable classes via date static constructors.
      ndossche

  • dom

    • Fix memory leak when edge case is hit when registering xpath callback.
      ndossche
    • Fixed bug GH-20395 (querySelector and querySelectorAll requires elements in $selectors to be lowercase).
      ndossche
    • Fix missing NUL byte check on C14NFile().
      ndossche

  • fibers

    • Fixed bug GH-20483 (ASAN stack overflow with fiber.stack_size INI small value).
      David Carlier

  • ftp

    • Fixed bug GH-20601 (ftp_connect overflow on timeout).
      David Carlier

  • gd

    • Fixed bug GH-20511 (imagegammacorrect out of range input/output values).
      David Carlier
    • Fixed bug GH-20602 (imagescale overflow with large height values).
      David Carlier

  • intl

    • Fixed bug GH-20426 (Spoofchecker::setRestrictionLevel() error message suggests missing constants).
      DanielEScherzer

  • libxml

    • Fix some deprecations on newer libxml versions regarding input buffer/parser handling.
      ndossche

  • mbstring

    • Fixed bug GH-20491 (SLES15 compile error with mbstring oniguruma).
      ndossche
    • Fixed bug GH-20492 (mbstring compile warning due to non-strings).
      ndossche

  • mysqli

    • Make mysqli_begin_transaction() report errors properly.
      Kamil Tekiela

  • mysqlnd

    • Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address enclosed in square brackets).
      Remi

  • opcache

    • Fixed bug GH-20329 (opcache.file_cache broken with full interned string buffer).
      Arnaud

  • pdo

  • phar

    • Fixed bug GH-20442 (Phar does not respect case-insensitiveness of __halt_compiler() when reading stub).
      ndossche
      TimWolla
    • Fix broken return value of fflush() for phar file entries.
      ndossche
    • Fix assertion failure when fseeking a phar file out of bounds.
      ndossche

  • phpdbg

    • Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
      Girgias

  • spl

    • Fixed bug GH-20614 (SplFixedArray incorrectly handles references in deserialization).
      ndossche

  • standard

    • Fix memory leak in array_diff() with custom type checks.
      ndossche
    • Fixed bug GH-20583 (Stack overflow in http_build_query via deep structures).
      ndossche
    • Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
      ndossche
    • Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
      ndossche
    • Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)
      ndossche

  • streams

    • Fixed bug GH-20370 (User stream filters could violate typed property constraints).
      alexandre-daubois

  • tidy

    • Fixed bug GH-20374 (PHP with tidy and custom-tags).
      ndossche

  • xml

    • Fixed bug GH-20439 (xml_set_default_handler() does not properly handle special characters in attributes when passing data to callback).
      ndossche

  • zip

    • Fix crash in property existence test.
      ndossche
    • Don't truncate return value of zip_fread() with user sizes.
      ndossche

  • zlib

    • Fix assertion failures resulting in crashes with stream filter object parameters.
      ndossche

PHP 8.4


  Represents a security release