CVE-2021-21708: UAF due to php_filter_float() failing

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-27 · updated 2026-06-17
Weakness: CWE-416

Description

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Affected products

PHP: from 7.4.0 before 7.4.28; from 8.0.0 before 8.0.16; from 8.1.0 before 8.1.3 — fixed in 7.4.28, 8.0.16, 8.1.3

How to fix

Upgrade to a fixed version: PHP 7.4.28, 8.0.16, 8.1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21708 or the next vulnerability affects your stack