Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.4 » 8.4.25 »

PHP 8.4.5

The latest release of PHP 8.4 is 8.4.25 which includes important security patches.

Source Code

  • PHP 8.4.5 (tar.gz)

    • sha256: f05530d350f1ffe279e097c2af7a8d78cab046ef99d91f6b3151b06f0ab05d05

  • PHP 8.4.5 (tar.bz2)

    • sha256: 9378c78887d0cd7462fc5c17f2de30c852f20f79d28795e2573fe3250d39436e

  • PHP 8.4.5 (tar.xz)

    • sha256: 0d3270bbce4d9ec617befce52458b763fd461d475f1fe2ed878bb8573faed327

Change Log

  • bcmath

    • Fixed bug GH-17398 (bcmul memory leak).
      SakiTakamachi

  • core

    • Fixed bug GH-17623 (Broken stack overflow detection for variable compilation).
      ilutov
    • Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
      timwolla
    • Fix fallback paths in fast_long_{add,sub}_function.
      nielsdos
    • Fixed bug OSS-Fuzz #391975641 (Crash when accessing property backing value by reference).
      ilutov
    • Fixed bug GH-17718 (Calling static methods on an interface that has `__callStatic` is allowed).
      timwolla
    • Fixed bug GH-17713 (ReflectionProperty::getRawValue() and related methods may call hooks of overridden properties).
      Arnaud
    • Fixed bug GH-17916 (Final abstract properties should error).
      DanielEScherzer
    • Fixed bug GH-17866 (zend_mm_heap corrupted error after upgrading from 8.4.3 to 8.4.4).
      nielsdos
    • Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)
      ilutov

  • dom

    • Fixed bug GH-17609 (Typo in error message: Dom\NO_DEFAULT_NS instead of Dom\HTML_NO_DEFAULT_NS).
      nielsdos
    • Fixed bug GH-17802 (\Dom\HTMLDocument querySelector attribute name is case sensitive in HTML).
      nielsdos
    • Fixed bug GH-17847 (xinclude destroys live node).
      nielsdos
    • Fix using Dom\Node with Dom\XPath callbacks.
      nielsdos

  • ffi

    • Fix FFI Parsing of Pointer Declaration Lists.
      davnotdev

  • fpm

    • Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).
      Jakub Zelenka

  • gd

    • Fixed bug GH-17703 (imagescale with both width and height negative values triggers only an Exception on width).
      David Carlier
    • Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
      David Carlier

  • ldap

    • Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys).
      nielsdos
      7u83

  • libxml

    • Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
      nielsdos
    • Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      timwolla

  • mbstring

    • Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).
      cmb

  • opcache

    • Fixed bug GH-17654 (Multiple classes using same trait causes function JIT crash).
      nielsdos
    • Fixed bug GH-17577 (JIT packed type guard crash).
      nielsdos
      Dmitry
    • Fixed bug GH-17747 (Exception on reading property in register-based FETCH_OBJ_R breaks JIT).
      Dmitry
      nielsdos
    • Fixed bug GH-17715 (Null pointer deref in observer API when calling cases() method on preloaded enum).
      Bob
    • Fixed bug GH-17868 (Cannot allocate memory with tracing JIT on 8.4.4).
      nielsdos

  • pdo_sqlite

    • Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
      cmb
    • Fix cycle leak in sqlite3 setAuthorizer().
      nielsdos
    • Fix memory leaks in pdo_sqlite callback registration.
      nielsdos

  • phar

    • Fixed bug GH-17808: PharFileInfo refcount bug.
      nielsdos

  • phpdbg

    • Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer).
      nielsdos
    • Fix memory leak in phpdbg calling registered function.
      nielsdos

  • reflection

    • Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).
      DanielEScherzer
    • Fixed missing final and abstract flags when dumping properties.
      DanielEScherzer

  • standard

    • Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths).
      Jakub Zelenka

  • streams

    • Fixed bug GH-17650 (realloc with size 0 in user_filters.c).
      nielsdos
    • Fix memory leak on overflow in _php_stream_scandir().
      nielsdos
    • Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      Jakub Zelenka
    • Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      Jakub Zelenka
    • Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      Jakub Zelenka
    • Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      Jakub Zelenka

  • windows

    • Fixed phpize for Windows 11 (24H2).
      bwoebi
    • Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).
      cmb

  • zlib

    • Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
      nielsdos
    • Fix memory leak when encoding check fails.
      nielsdos
    • Fix zlib support for large files.
      nielsdos

PHP 8.4


  Represents a security release