Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.4 » 8.4.25 »

PHP 8.4.23

The latest release of PHP 8.4 is 8.4.25 which includes important security patches.

Source Code

Change Log

  • core

    • Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block).
      Pratik Bhujel
    • Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).
      iliaal

  • bcmath

    • Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round().
      edorian

  • date

    • Fix incorrect recurrence check of DatePeriod::createFromISO8601String().
      ndossche

  • dom

    • Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve xs:QName with prefix from imported schema).
      David Carlier

  • exif

    • Read correct value for single and double tags.
      ndossche

  • gd

    • Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return).
      iliaal
    • Fixed bug GH-19666 (imageconvolution() unexpected nan filter value).
      David Carlier
    • Fixed bug GH-19739 (imageellipse/imagefilledellipse overflow).
      David Carlier
    • Fixed bug GH-19730 (imageaffine overflow).
      David Carlier

  • intl

    • Fix incorrect argument positions for uninitialized calendar arguments in IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo(), and for invalid start/end arguments in transliterator_transliterate().
      Weilin Du
    • Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types.
      Weilin Du
    • Fixed Spoofchecker restriction-level APIs to only be exposed with ICU 53 and later.
      Graham Campbell

  • mysqli

    • Fix stmt->query leak in mysqli_execute_query() validation errors.
      David Carlier

  • opcache

    • Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading).
      Levi Morrison
    • Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).
      ptondereau
      iliaal

  • openssl

    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)
      David Carlier

  • phar

    • Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix.
      Weilin Du
    • Fixed an integer underflow when parsing ZIP extra fields.
      Weilin Du

  • reflection

    • Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading.
      jorgsowa

  • sqlite

    • Fix error checks for column retrieval.
      ndossche

  • zlib

    • Fixed memory leak if deflate initialization fails and there is a dict.
      ndossche
    • Fixed memory leak in inflate_add().
      ndossche

  • zip

    • Fixed error-related memory leaks.
      ndossche

PHP 8.4


  Represents a security release