PHP Release 7.4.32


PHP 7.4.32 Release Announcement

The PHP development team announces the immediate availability of PHP 7.4.32. This is a security release.

This release addresses an infinite recursion with specially constructed phar files, and prevents a clash with variable name mangling for the __Host/__Secure HTTP headers.

All PHP 7.4 users are encouraged to upgrade to this version.

For source downloads of PHP 7.4.32 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Source Code
PHP 7.4.32 (tar.gz)
SHA256: 197e3372afd69694eb6b230838305eb9e1cbe5db272e0fa3bbe0d38e329a95bc
PHP 7.4.32 (tar.bz2)
SHA256: 9b4c3c21ffbb4f35d7b865dbf88538bba1742335248ae1cc2afc303d456e3aa6
PHP 7.4.32 (tar.xz)
SHA256: 323332c991e8ef30b1d219cb10f5e30f11b5f319ce4c6642a5470d75ade7864a
Change Logs
core
  • Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628).
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629).
To Top