php-8.5.5

[Bruce Dubbs]

New point version.

[Bruce Dubbs]

09 Apr 2026, PHP 8.5.5

• Core:
  • Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed trait properties)-
  • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies)-

• Bz2:
  • Fix truncation of total output size causing erroneous errors.

• DOM:
  • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes)-

• FFI:
  • Fixed resource leak in FFI::cdef() onsymbol resolution failure.

• GD:
  • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support).

• Opcache:
  • Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script)-
  • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results).
  • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context)-
  • Fixed bug GH-21395 (uaf in jit).

• OpenSSL:
  • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys)-
  • Fix missing error propagation for BIO_printf() calls.

• PCNTL:
  • Fixed signal handler installation on AIX by bumping the storage size of the num_signals global-

• PCRE:
  • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl-

• Phar:
  • Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar)-

• Phar:
  • Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar)-

• SNMP:
  • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments)-

• SOAP:
  • Fixed Set-Cookie parsing bug wrong offset while scanning attributes.

• SPL:
  • Fixed bug GH-21454 (missing write lock validation in SplHeap).

• Standard:
  • Fixed bug GH-20906 (Assertion failure when messing up output buffers).
  • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize).

• Sysvshm:
  • Fix memory leak in shm_get_var() when variable is corrupted.

• XSL:
  • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument)-
  • Fixed bug GH-21496 (UAF in dom_objects_free_storage).

[Bruce Dubbs]

Fixed at commit b515f32837.