Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-9026

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

Published

2024-10-08T04:15:11.060

Last Modified

2025-08-19T16:26:19.737

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 3.3 (LOW)

Weaknesses
  • Type: Secondary
    CWE-117
    CWE-158
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application php php < 8.1.30 Yes
Application php php < 8.2.24 Yes
Application php php < 8.3.12 Yes
References