CVE-2026-17543

Public on 2026-07-30
Modified on 2026-08-01
Description
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Severity
Critical severity
Critical
See what this means
CVSS v3 Base Score
9.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Php8.2 Extra php 2026-08-04 ALAS2PHP8.2-2026-013 Fixed
Amazon Linux 2 - Core php Not Affected
Amazon Linux 2023 php8.1 No Fix Planned
Amazon Linux 2023 php8.2 2026-08-04 ALAS2023-2026-2043 Fixed
Amazon Linux 2023 php8.3 2026-08-04 ALAS2023-2026-2044 Fixed
Amazon Linux 2023 php8.4 2026-08-04 ALAS2023-2026-2042 Fixed
Amazon Linux 2023 php8.5 2026-08-04 ALAS2023-2026-2041 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-17543 Mitre: CVE-2026-17543