CVE-2022-31626: Debian Linux

High severity, CVSS 8.8. EPSS: 58.1% chance of exploitation in the next 30 days.

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• PHP PHP: from 7.4.0, before 7.4.30 (fixed in 7.4.30); from 8.0.0, before 8.0.20 (fixed in 8.0.20); from 8.1.0, before 8.1.7 (fixed in 8.1.7)

Published 2022-06-16. Last modified 2026-06-17.