Coverage: what has actually been tested

Honest limits of this table

• Apache mod_php and php-fpm were both tested on every minor whose cell shows a result — 5.6 and 7.0 through 8.5. PHP 5.4 and 5.5 are the only exceptions (next notes).
• PHP 5.4 was tested on PHP's built-in CLI server only: its stock image has no cgi-fcgi (php-fpm skipped) and there is no php:5.4-apache image.
• 1 minors were not independently run: 5.5. They share a generation's code path with a version that passed — a reason to expect they work, not a test result, and not claimed as passing.
• The CVE's session.upload_progress header-parsing path was not reproduced. Upload-progress on and off were both tested, to confirm Howdah works either way.
• CVE-2012-1823 (php-cgi argument injection) is out of reach and not protected: that query is consumed by php-cgi during its own startup, before any PHP extension loads. It belongs with CVE-2019-11043 — both happen before extension code runs. Use a web-server or front-proxy rule.
• The input-shape and request-header limits are enforced best-effort on the response (the variable is always dropped and logged; the 403 may arrive at request shutdown on lazy-superglobal SAPIs). See Configuration.
• Layer 2 (input inspection, added in 1.1) is not covered by this table. It detects and logs SQL injection, path traversal and command-injection patterns in request values, is best-effort and can be bypassed, which is why it logs, and it does not block by default.
• Layer 3 (sink hardening, added in 1.2) is not covered by this table either; its per-version table is on the home page. It guards command execution, unserialize, include/require and eval (the last two on PHP 5.x too since 1.3), plus phar:// and SSRF (new in 1.3, both off by default). It detects and logs by default, and does not block unless explicitly armed. It is best-effort and can be bypassed.
• phar (1.3): on PHP 5.x/7.x it covers phar metadata deserialization through the stream wrapper; on PHP 8.x it is detection and denial of phar:// use only, with no deserialization claim. The direct Phar API (new Phar, PharData, Phar::loadPhar, Phar::mapPhar, Phar::getMetadata) is not covered. Another extension re-registering phar, or a static phar build, fails open.
• SSRF (1.3): best-effort, resolve-at-check-time detection, not a connection-time boundary. It is bypassed by DNS rebinding, redirects, curl_multi_*, CURLOPT_RESOLVE/CONNECT_TO and a non-string or absent CURLOPT_URL. Not hooked: copy, file, readfile, SoapClient, DOMDocument::load*, simplexml_load_file. It adds a getaddrinfo per distinct outbound host with no timeout; more than 32 resolved addresses are capped and a host over 256 bytes is treated as suspicious.
• PHP 5.x include (1.3): checked at compile time, so a file served from a warm opcache is not re-inspected. eval is unaffected, and the PHP 7.0+ opcode handler is not affected by opcache.
• Provenance: the 1.3 Layer 3 mechanisms were verified on PHP 5.4, 5.6, 7.4, 8.3 and 8.5. Other minors build and are expected to work but are not independently verified. A debug-build leak review is pending.
• Coverage results were recorded on Linux x86_64. aarch64 is build-verified for all 14 minors (PHP 5.4 included since the 1.2.2 build fix); the scenario matrix has not been re-run on arm64.