CVE-2026-17545: PHP Windows Reserved Device Names DOS Flaw

CVE-2026-17545 Overview

CVE-2026-17545 affects PHP running on Windows. The filesystem and stream APIs fail to reject reserved device names such as CON, PRN, AUX, NUL, COM1 through COM9, LPT1 through LPT9, CONIN$, and CONOUT$ when they appear as components of a path. An attacker-controlled filename reaches CreateFileW() and opens a Windows device instead of the intended regular file. The result is a denial-of-service condition where requests block or hang, exhausting worker processes.

Critical Impact
Remote attackers can submit filenames containing reserved Windows device names to exhaust PHP worker processes and cause application-level denial of service.

Affected Products

PHP running on Microsoft Windows platforms
Applications using PHP filesystem and stream APIs that accept untrusted path components
Web applications processing user-supplied filenames on Windows hosts

Discovery Timeline

2026-09-25 - CVE-2026-17545 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-17545

Vulnerability Analysis

The vulnerability is categorized under [CWE-67] Improper Handling of Windows Device Names. PHP's filesystem functions on Windows pass path arguments to the Win32 CreateFileW() API without filtering reserved DOS device names. Windows resolves names like CON, NUL, or COM1 to physical or virtual devices regardless of the apparent directory prefix. When PHP opens such a name, the handle refers to a device rather than a file on disk.

Operations that expect normal file semantics then behave unpredictably. Reads from CON wait for console input that never arrives. Writes to COM1 may block waiting on a serial device. Each stalled request ties up a PHP worker thread or process. Repeated requests exhaust the available worker pool, denying service to legitimate users.

Root Cause

The root cause is missing validation of path components against the Windows reserved device namespace. PHP's cross-platform filesystem layer treats Windows path strings as regular file paths. It does not strip, reject, or escape the legacy DOS device names that the Win32 subsystem still honors for backward compatibility.

Attack Vector

Exploitation requires an application that forwards untrusted input into PHP filesystem functions such as fopen(), file_get_contents(), file_exists(), or stream wrappers. An attacker submits a request where the filename parameter contains a reserved device name, for example uploads/CON or data/LPT1.txt. PHP opens the device, the operation blocks, and the worker remains occupied until a timeout fires. Attack complexity is high because exploitation depends on the target application exposing a vulnerable code path and running on Windows.

Technical details are documented in the PHP GitHub Security Advisory GHSA-9f67-6fw4-hpfp.

Detection Methods for CVE-2026-17545

Indicators of Compromise

Web server access logs containing request parameters with reserved device names such as CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9, CONIN$, or CONOUT$
Sudden spikes in long-running or hung PHP-FPM or FastCGI worker processes on Windows hosts
Elevated 502 or 504 response rates from PHP applications coinciding with worker pool exhaustion

Detection Strategies

Inspect HTTP request parameters and uploaded filenames for case-insensitive matches against the Windows reserved device name list
Correlate PHP worker thread timeouts with inbound request content to identify abusive clients
Review application logs for repeated failed fopen() or stream operations against unusual path components

Monitoring Recommendations

Track PHP-FPM pool saturation metrics and alert when active workers approach configured maximums
Monitor Windows handle counts on php-cgi.exe and php-fpm.exe processes for sustained growth
Deploy web application firewall rules that log any path parameter resolving to a reserved device name

How to Mitigate CVE-2026-17545

Immediate Actions Required

Apply the PHP security update referenced in GHSA-9f67-6fw4-hpfp as soon as patched builds are available for your PHP branch
Audit application code that passes user-controlled input to filesystem or stream functions and add validation against reserved Windows device names
Deploy WAF rules to block requests whose path or filename parameters match the Windows reserved device namespace

Patch Information

Refer to the official PHP security advisory GHSA-9f67-6fw4-hpfp for fixed version numbers and backport details. Upgrade all Windows PHP installations to a patched release.

Workarounds

Reject any filename whose base component matches CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9, CONIN$, or CONOUT$ in a case-insensitive comparison, before calling filesystem APIs
Normalize uploaded filenames to server-generated identifiers rather than preserving client-supplied names
Configure PHP execution timeouts (max_execution_time, FastCGI request timeouts) low enough to release stalled workers before pool exhaustion
Where feasible, host PHP workloads on Linux containers to eliminate exposure to Windows device name semantics

bash

# Example PHP input validation to reject reserved Windows device names
$reserved = '/^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9]|CONIN\$|CONOUT\$)(\..*)?$/i';
$basename = pathinfo($userFilename, PATHINFO_FILENAME);
if (preg_match($reserved, $basename)) {
    http_response_code(400);
    exit('Invalid filename');
}