Linux · Security advisory · December 19, 2025

ELSA-2025-23309: Security update for 32 packages

ELSA-2025-23309, released December 19, 2025, fixes 3 CVEs across 32 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0116
67th percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
apcu-panelol 90:5.1.23-1.module+el9.6.0+90525+5083e899
phpol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-bcmathol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-cliol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-commonol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-dbaol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-dbgol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-develol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-embeddedol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-enchantol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-ffiol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-fpmol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-gdol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-gmpol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-intlol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-ldapol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-mbstringol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-mysqlndol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-odbcol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-opcacheol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-pdool 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-pecl-apcuol 90:5.1.23-1.module+el9.6.0+90525+5083e899
php-pecl-apcu-develol 90:5.1.23-1.module+el9.6.0+90525+5083e899
php-pecl-redis6ol 90:6.1.0-2.module+el9.6.0+90525+5083e899
php-pecl-rrdol 90:2.0.3-4.module+el9.6.0+90525+5083e899
php-pecl-xdebug3ol 90:3.3.1-1.module+el9.6.0+90525+5083e899
php-pecl-zipol 90:1.22.3-1.module+el9.6.0+90525+5083e899
php-pgsqlol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-processol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-snmpol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-soapol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3
php-xmlol 90:8.3.26-1.module+el9.4.0+90734+c13c2ce3

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-1735 pgsql extension does not check for errors during escaping 7.5 0.0116 None reported
High CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix 7.5 0.0112 None reported
High CVE-2025-1220 Null byte termination in hostnames 7.5 0.0074 None reported
Showing 1 to 3 of 3 1