PHP 8.5.2 Release Announcement

The PHP development team announces the immediate availability of PHP 8.5.2. This is a bug fix release.

All PHP 8.5 users are encouraged to upgrade to this version.

For source downloads of PHP 8.5.2 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.

Source Code

• PHP 8.5.2 (tar.gz)
  sha256: 379ccccefcc85f28286444cf01bc0db017c79d513417267f5bb1d804b8428c22
• PHP 8.5.2 (tar.bz2)
  sha256: f7efdeccc3a810b18920692306536b99a3ba86610dbd0795a296cf77d3fb3a06
• PHP 8.5.2 (tar.xz)
  sha256: cb75a9b00a2806f7390dd64858ef42a47b443b3475769c8af6af33a18b1381f1

Change Log

• core
  • Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
  • Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
  • Fixed bug GH-20714 (Uncatchable exception thrown in generator).
  • Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
  • Fixed bug GH-20745 ("Casting out of range floats to int" applies to strings).
• dom
  • Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
  • Fixed bug GH-20444 (Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
• exif
  • Fixed bug GH-20631 (Integer underflow in exif HEIF parsing when pos.size < 2).
• intl
  • Fix leak in umsg_format_helper().
• ldap
  • Fix memory leak in ldap_set_options().
• lexbor
  • Fixed bug GH-20668 (\Uri\WhatWg\Url::withHost() crashes (SEGV) for URLs using the file: scheme).
• mbstring
  • Fixed bug GH-20674 (mb_decode_mimeheader does not handle separator).
• openssl
  • Fixed bug GH-20802 (undefined behavior with invalid SNI_server_certs options).
• pcntl
  • Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
• phar
  • Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
  • Fix SplFileInfo::openFile() in write mode.
  • Fix build on legacy OpenSSL 1.1.0 systems.
  • Fixed bug #74154 (Phar extractTo creates empty files).
• session
  • Fix support for MM module.
• sqlite3
  • Fixed bug GH-20699 (SQLite3Result fetchArray return array|false, null returned).
• standard
  • Fix error check for proc_open() command.
  • Fix memory leak in mail() when header key is numeric.
  • Fixed bug GH-20582 (Heap Buffer Overflow in iptcembed).
• uri
  • Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns empty string).
• zlib
  • Fix OOB gzseek() causing assertion failure.