- CVE-2019-19246: heap buffer over-read in the bundled Oniguruma 4.7.1 str_lower_case_match(); the case-insensitive matcher advanced the target pointer during a multibyte case-fold comparison without re-checking it against the end of the buffer - CVE-2020-7062: NULL pointer dereference in the session upload-progress handler; an upload that ended before any file part was seen reached MULTIPART_EVENT_END with progress->data still unallocated, which was then dereferenced when session.upload_progress.cleanup was disabled - CVE-2021-21702: NULL pointer dereference in SoapClient; a malformed WSDL or XML response whose node carried no name was passed unchecked to soap_error1() and strcmp() - CVE-2021-21703: out-of-bounds read and write in the php-fpm scoreboard; an unprivileged worker could steer the root process past the end of the shared scoreboard array, allowing local privilege escalation - CVE-2024-11234: CRLF injection in the HTTP stream wrapper; with a proxy configured and request_fulluri enabled, a path containing CR or LF was pasted into the request line, permitting HTTP request smuggling - CVE-2025-1736: insufficient validation of end-of-line characters in user-supplied HTTP stream-wrapper headers; a header preceded by a bare LF, tab or space was accepted as present, which could suppress the Authorization header derived from URL credentials