PHP 8.3.18
- BCMath:
. Fixed bug GH-17398 (bcmul memory leak). (SakiTakamachi)
- Core:
. Fixed bug GH-17623 (Broken stack overflow detection for variable compilation). (ilutov)
. Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account). (timwolla)
. Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
. Fixed bug GH-17718 (Calling static methods on an interface that has `__callStatic` is allowed). (timwolla)
. Fixed bug GH-17797 (zend_test_compile_string crash on invalid script path). (David Carlier)
. Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235) (ilutov)
- DOM:
. Fixed bug GH-17847 (xinclude destroys live node). (nielsdos)
- FFI:
. Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)
- FPM:
. Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env). (Jakub Zelenka)
- GD:
. Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M). (David Carlier)
- LDAP:
. Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys). (nielsdos, 7u83)
- LibXML:
. Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714). (nielsdos)
. Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219) (timwolla)
- MBString:
. Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables). (cmb)
- Opcache:
. Fixed bug GH-17654 (Multiple classes using same trait causes function JIT crash). (nielsdos)
. Fixed bug GH-17577 (JIT packed type guard crash). (nielsdos, Dmitry)
. Fixed bug GH-17899 (zend_test_compile_string with invalid path when opcache is enabled). (David Carlier)
. Fixed bug GH-17868 (Cannot allocate memory with tracing JIT). (nielsdos)
- PDO_SQLite:
. Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults). (cmb)
. Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)
- Phar:
. Fixed bug GH-17808: PharFileInfo refcount bug. (nielsdos)
- PHPDBG:
. Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer). (nielsdos)
. Fix memory leak in phpdbg calling registered function. (nielsdos)
- Reflection:
. Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c). (DanielEScherzer)
- Standard:
. Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths). (Jakub Zelenka)
- Streams:
. Fixed bug GH-17650 (realloc with size 0 in user_filters.c). (nielsdos)
. Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
. Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736) (Jakub Zelenka)
. Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861) (Jakub Zelenka)
. Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734) (Jakub Zelenka)
. Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217) (Jakub Zelenka)
- Windows:
. Fixed phpize for Windows 11 (24H2). (bwoebi)
. Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib). (cmb)
- Zlib:
. Fixed bug GH-17745 (zlib extension incorrectly handles object arguments). (nielsdos)
. Fix memory leak when encoding check fails. (nielsdos)
. Fix zlib support for large files. (nielsdos)
PHP 8.3.18 has been released, featuring a range of fixes and enhancements. The updates cover fixes for issues in BCMath, Core, DOM, FFI, FPM, GD, LDAP, LibXML, MBString, Opcache, PDO_SQLite, Phar, PHPDBG, Reflection, Standard, Streams, Windows, and Zlib. BCMath has resolved a memory leak issue, while Core has addressed a malfunction in stack overflow detection for variable compilation. GD has addressed a memory leak in mb_convert_variables, and Opcache has resolved a memory leak in phpdbg when invoking registered functions. Phar has resolved an issue with the PharFileInfo reference count, and PHPDBG has made partial progress in addressing a memory leak related to the phpdbg calling registered functions. Windows has addressed the phpize issue for Windows 11 (24H2), and Zlib has resolved a memory leak that occurs when encoding checks fail, in addition to supporting large files.
