CVE-2026-7258

score

<0.1

cvss

7.5

epss

0.4%

published

2026-05-10

kev added

—

first seen

2026-10-21

PHP 8.2.* < 8.2.31, 8.3.* < 8.3.31, 8.4.* < 8.4.21, and 8.5.* < 8.5.6 contain a denial of service caused by passing signed char to ctype functions like isxdigit() on systems with signed char and optimized table-lookup, letting attackers trigger DoS remotely, exploit requires crafted input.