Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.3 » 8.3.33 »

PHP 8.3.23

The latest release of PHP 8.3 is 8.3.33 which includes important security patches.

Source Code

Change Log

  • core

    • Fixed GH-18695 (zend_ast_export() - float number is not preserved).
      Oleg Efimov
    • Do not delete main chunk in zend_gc.
      danog
      Arnaud
    • Fix compile issues with zend_alloc and some non-default options.
      nielsdos

  • curl

    • Fix memory leak when setting a list via curl_setopt fails.
      nielsdos
    • Fix incorrect OpenSSL version detection.
      Peter Kokot

  • date

    • Fix leaks with multiple calls to DatePeriod iterator current().
      nielsdos

  • fpm

    • Fixed GH-18662 (fpm_get_status segfault).
      txuna

  • hash

    • Fixed bug GH-14551 (PGO build fails with xxhash).
      nielsdos

  • intl

    • Fix memory leak in intl_datetime_decompose() on failure.
      nielsdos
    • Fix memory leak in locale lookup on failure.
      nielsdos

  • odbc

    • Fix memory leak on php_odbc_fetch_hash() failure.
      nielsdos

  • opcache

    • Fixed bug GH-18743 (Incompatibility in Inline TLS Assembly on Alpine 3.22).
      nielsdos
      Arnaud

  • openssl

    • Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
      nielsdos
    • Fixed bug #74796 (Requests through http proxy set peer name).
      Jakub Zelenka

  • phar

    • Add missing filter cleanups on phar failure.
      nielsdos
    • Fixed bug GH-18642 (Signed integer overflow in ext/phar fseek).
      nielsdos

  • phpdbg

    • Fix 'phpdbg --help' segfault on shutdown with USE_ZEND_ALLOC=0.
      nielsdos

  • pdo odbc

    • Fix memory leak if WideCharToMultiByte() fails.
      nielsdos

  • pgsql

    • Fix warning not being emitted when failure to cancel a query with pg_cancel_query().
      Girgias
    • Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
      Jakub Zelenka

  • random

    • Fix reference type confusion and leak in user random engine.
      nielsdos
      timwolla

  • readline

    • Fix memory leak when calloc() fails in php_readline_completion_cb().
      nielsdos

  • soap

    • Fix memory leaks in php_http.c when call_user_function() fails.
      nielsdos
    • Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP ExtensionAdd commentMore actions via Large XML Namespace Prefix). (CVE-2025-6491)
      Lekssays
      nielsdos

  • standard

    • Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)
      Jakub Zelenka

  • tidy

    • Fix memory leak in tidy output handler on error.
      nielsdos
    • Fix tidyOptIsReadonly deprecation, using tidyOptGetCategory.
      David Carlier

PHP 8.3


  Represents a security release