CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
| CWE | CWE-67 |
| Vendor | php group |
| Product | php |
| Published | Sep 25, 2026 |
| Last Updated | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for php group php
Be the first to know when new unknown vulnerabilities affecting php group php are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
PHP Group / PHP
8.2.* < 8.2.34 8.3.* < 8.3.35 8.4.* < 8.4.26 8.5.* < 8.5.11
References
Credits
🔍 @Crispr (GitHub) 🔍 @OSTIF-Derek Shivam Mathur Jakub Zelenka