Php: Stack overflow in phar with circular symlinks (CVE-2026-7260)

This advisory addresses two security vulnerabilities in PHP 8.3 as packaged for Red Hat Enterprise Linux 9. CVE-2026-17543 is a SQL injection vulnerability in the ext-pgsql extension caused by improper handling of backslash escaping. CVE-2026-7260 is a denial of service vulnerability triggered by circular symbolic links in phar archives. Red Hat has rebased PHP to version 8.3.33 in the 9.8.z update stream to remediate these issues. The advisory includes bug fixes and enhancements alongside the security fixes.

Successful exploitation of CVE-2026-17543 could allow an attacker to perform SQL injection attacks via the ext-pgsql extension, potentially compromising database integrity or confidentiality. CVE-2026-7260 could allow an attacker to cause a denial of service by exploiting circular symbolic links in phar archives, potentially disrupting PHP-based services. Red Hat rates the overall security impact as Important.

Red Hat has released an updated PHP 8.3 package rebased to version 8.3.33 that fixes these vulnerabilities. Users of Red Hat Enterprise Linux 9 and related variants should apply the update as described in the Red Hat advisory RHSA-2026:57539 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.