Cyber Resilience

CVE-2024-9026

Php 8.1.0 – 8.1.30

Public PoC
Published
08 October 2024
Modified
03 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 3.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0048 39th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-9026 is a low-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Php Php. Its CVSS base score is 3.3 (Low).

Operationally, ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A09:2025 Security Logging and Alerting Failures

EU & UK References

Vulnerability Data

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up…

more

to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

CWE(s)
CWE-117CWE-158NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2023-0567Same product: Php Php
CVE-2024-11234Same product: Php Php
CVE-2023-3247Same product: Php Php
CVE-2026-6735Same product: Php Php
CVE-2024-11235Same product: Php Php
CVE-2024-11236Same product: Php Php
CVE-2024-2757Same product: Php Php
CVE-2025-6491Same product: Php Php
CVE-2025-1220Same product: Php Php
CVE-2026-7263Same product: Php Php

Affected Assets

php
php
8.1.0 — 8.1.30 · 8.2.0 — 8.2.24 · 8.3.0 — 8.3.12

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.10

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices and coding standards directly require output sanitization for logs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect log injection flaws but does not prevent them at the source.

A.8.15 Logging partial match
degrades

Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.

A.8.16 Monitoring activities partial match
detects

Monitoring activities rely on trustworthy logs but do not ensure log message integrity.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC includes coding standards that reduce log-related weaknesses but does not specifically address logging.

A.8.26 Application security requirements partial match
prevents

Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.

References