CVE-2022-31628: phar wrapper can occur dos when using quine gzip file

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-28 · updated 2026-06-17
Weakness: CWE-674

Description

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Affected products

Debian Linux: 10.0, 11.0
Fedoraproject Fedora: 35, 36, 37
PHP: before 7.4.31; from 8.0.0 before 8.0.24; from 8.1.0 before 8.1.11 — fixed in 7.4.31, 8.0.24, 8.1.11

How to fix

Upgrade to a fixed version: PHP 7.4.31, 8.0.24, 8.1.11. Check the vendor advisory for mitigations.

References

https://bugs.php.net/bug.php?id=81726
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/
https://security.gentoo.org/glsa/202211-03
https://security.netapp.com/advisory/ntap-20221209-0001/
https://www.debian.org/security/2022/dsa-5277
https://bugs.php.net/bug.php?id=81726
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/

Get alerted when CVE-2022-31628 or the next vulnerability affects your stack