Executive brief
A vulnerability in PHP's handling of Phar archives (a format used to package PHP applications) can allow an attacker to crash the PHP process. By providing a specially crafted archive file containing circular links, an attacker can trigger a system crash, leading to a denial of service. This could disrupt web services or applications that process user-uploaded archive files.
Technical details
The phar_get_link_source() function in ext/phar/util.c recursively follows symbolic links within Phar archives without implementing depth limits or cycle detection. An attacker can craft a tar-based Phar archive containing circular symbolic links (e.g., File A points to File B, which points back to File A). When PHP attempts to resolve these links, it enters an unbounded recursion that exhausts the C stack, resulting in a segmentation fault and process crash. This is exploitable if an application processes untrusted Phar or Tar files. Patches are available in PHP versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9.
Affected products
- PHP Group PHP 8.2.0 - 8.2.32, 8.3.0 - 8.3.32, 8.4.0 - 8.4.23, 8.5.0 - 8.5.8
Timeline
- 2026-07-30: advisory: GHSA-vc5h-9ppw-p5f3 published by PHP Group
- 2026-07-30: patched: Fixed versions released