CVE-2022-31625: Debian Linux

High severity, CVSS 8.1. EPSS: 3.8% chance of exploitation in the next 30 days.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• PHP PHP: from 7.4.0, before 7.4.30 (fixed in 7.4.30); from 8.0.0, before 8.0.20 (fixed in 8.0.20); from 8.1.0, before 8.1.7 (fixed in 8.1.7)

Published 2022-06-16. Last modified 2026-06-17.