CVE-2026-17545

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This can cause application worker processes to block or hang indefinitely, resulting in a Denial of Service (DoS) through resource exhaustion.

This vulnerability is specific to PHP on Windows, where reserved device names in attacker-controlled paths can open devices and hang worker processes. Red Hat Enterprise Linux and other Red Hat products ship PHP for Linux only, so the vulnerable Windows path-handling code is not present. The Moderate rating reflects the upstream Windows denial-of-service impact; Red Hat product deployments are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No action is required for Red Hat Enterprise Linux or other Linux-based Red Hat products, which do not implement Windows reserved device-name handling. On Windows PHP deployments, upgrade to a fixed PHP release and reject user-controlled path components that resolve to reserved device names.