{"schema":"threatline.record/2","record":{"id":"CVE-2026-17545","aliases":["GHSA-9f67-6fw4-hpfp"],"summary":"PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS","details":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.","categories":["Runtimes & languages"],"product":"PHP","vendor":"PHP Group","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","source_modified_at":"2026-09-25T20:43:34.157Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"PHP","vendor":"PHP Group","versions":[{"status":"affected","version":"8.2.*","lessThan":"8.2.34","versionType":"semver"},{"status":"affected","version":"8.3.*","lessThan":"8.3.35","versionType":"semver"},{"status":"affected","version":"8.4.*","lessThan":"8.4.26","versionType":"semver"},{"status":"affected","version":"8.5.*","lessThan":"8.5.11","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"range":"<8.2.34"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"range":"<8.3.35"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"range":"<8.4.26"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"range":"<8.5.11"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","source_modified_at":"2026-09-25T20:43:34.157Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PHP","ecosystem":null},"version":"8.2.34","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","source_modified_at":"2026-09-25T20:43:34.157Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PHP","ecosystem":null},"version":"8.3.35","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","source_modified_at":"2026-09-25T20:43:34.157Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PHP","ecosystem":null},"version":"8.4.26","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","source_modified_at":"2026-09-25T20:43:34.157Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"PHP","ecosystem":null},"version":"8.5.11","basis":"first unaffected version stated in the CVE record"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"version":"8.2.34"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"version":"8.3.35"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"version":"8.4.26"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","source_modified_at":"2026-09-25T18:16:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"php-src"},"version":"8.5.11"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00322,"percentile":0.24034,"score_date":"2026-10-23"},"published_at":"2026-09-25T20:18:11.288Z","modified_at":"2026-09-25T20:43:34.157Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-17545","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-25T20:43:34.157Z"},{"source":"GitHub Advisory Database","url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T18:16:20Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-17545","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp","tags":["exploit"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-25T20:43:10.043800Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T20:43:34.157Z","content_hash":"515e95a9083a1f29fff7bb3b490d2d4398296afab1804c5a7fda683ae5244723"}}