UpHeron
All vulnerabilities

Servers and applications

CVE-2019-9022

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

Severity
High 7.5
Published
22 Feb 2019
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
7.1.26, 7.2.14, 7.3.2
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 7.0.0 before 7.1.26
  • From 7.2.0 before 7.2.14
  • From 7.3.0 before 7.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-9022
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-9022