With pdo_mysql and mysqlnd, an overly long password causes a buffer overflow that may allow code execution when a third party can choose the database host and password.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.1 | < 8.1.7 | 8.1.7 |
| PHP 8.0 | < 8.0.20 | 8.0.20 |
| PHP 7.4 | < 7.4.30 | 7.4.30 |
Older branches: not assessed
Exploitation conditions
- Attacker can control the database host and password (e.g. database admin tools)
Remediation
Upgrade to 7.4.30, 8.0.20, 8.1.7 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 7.5 v3.1 | NVD | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: Sources disagree on the score (7.5 vs 8.8).