From a7e88ee780e8b897a132fe38fd8cf41779f63f25 Mon Sep 17 00:00:00 2001 From: Alexandre Daubois Date: Thu, 5 Nov 2026 09:15:53 +0100 Subject: [PATCH] [skip ci] SECURITY.md: exclude bugs in third-party libraries from the policy --- SECURITY.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index b6337a80bdc4..e2636c535a35 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -39,6 +39,13 @@ are not limited to): - Memory exhaustion from a size the input declares, where `memory_limit` refuses the allocation and only the current request dies. +- Bugs in third-party libraries, whether bundled (like lexbor/lexbor, libgd, + libmagic, PCRE2 or timelib) or linked from the system (like + libxml2, OpenSSL or libcurl). Please report them to the library's maintainers + directly. Issues in how PHP uses these libraries remain in scope. The bundled + libraries and their upstream locations are listed in + [CONTRIBUTING.md](CONTRIBUTING.md#php-source-code-directory-structure). + When creating reports, please **skip** the theatrics. Drop the impact essay, send a short reproducer with the few lines that matter, and make each point once. This allows us to triage and respond to your report quickly.