diff --git a/ext/dom/tests/modern/html/encoding/HTMLDocument_createFromFile_http_header.phpt b/ext/dom/tests/modern/html/encoding/HTMLDocument_createFromFile_http_header.phpt
index 5c602b87f23e..5164ac68041d 100644
--- a/ext/dom/tests/modern/html/encoding/HTMLDocument_createFromFile_http_header.phpt
+++ b/ext/dom/tests/modern/html/encoding/HTMLDocument_createFromFile_http_header.phpt
@@ -46,6 +46,7 @@ $tests = [
         "text/html; ;;   ; ;; Charset=\"ISO-8859-1\"",
         "text/html;Charset=\"ISO-8859-1",
         "tex.t/h#\$%!&'*%2B-.^_`|~tml;Charset=\"ISO-8859-1\"", // Note: have to encode + as 2B because of implementation details of http_server()
+        "text/html; abcd=ef;charset=ISO-8859-1",
     ],
     "Valid input, but invalid encoding name" => [
         "text/html;Charset=\"ISO-8859-1\\",
@@ -100,6 +101,7 @@ foreach ($tests as $name => $headers) {
 äöü
 äöü
 äöü
+äöü
 --- Valid input, but invalid encoding name ---
 ���
 ���
diff --git a/ext/filter/filter.c b/ext/filter/filter.c
index 9dbd6dceda53..b6e6332381e9 100644
--- a/ext/filter/filter.c
+++ b/ext/filter/filter.c
@@ -296,10 +296,10 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval
 				filter_func.name,
 				ZSTR_VAL(copy_for_throwing)
 			);
-			zend_string_delref(copy_for_throwing);
+			zend_string_release(copy_for_throwing);
 			return;
 		}
-		zend_string_delref(copy_for_throwing);
+		zend_string_release(copy_for_throwing);
 		copy_for_throwing = NULL;
 	}
 
diff --git a/ext/filter/tests/filter_throw_on_failure_leak.phpt b/ext/filter/tests/filter_throw_on_failure_leak.phpt
new file mode 100644
index 000000000000..d42896a94e8f
--- /dev/null
+++ b/ext/filter/tests/filter_throw_on_failure_leak.phpt
@@ -0,0 +1,37 @@
+--TEST--
+filter: FILTER_THROW_ON_FAILURE does not leak the preserved input string
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+// php_zval_filter() copies the input string so it can be quoted in the
+// exception message. A non-string scalar input (here a float / a large int)
+// is turned into a fresh heap string by convert_to_string(), so the copy is
+// the sole extra owner. Releasing it with zend_string_delref() decremented
+// without freeing, leaking one string per call on both the failure and the
+// success path. Loop and assert memory stays flat.
+function leakcheck(callable $fn): bool {
+    $fn();
+    $before = memory_get_usage();
+    for ($i = 0; $i < 2000; $i++) {
+        $fn();
+    }
+    return memory_get_usage() - $before === 0;
+}
+
+// Validation fails -> exception thrown.
+var_dump(leakcheck(function () {
+    try {
+        filter_var(1.5, FILTER_VALIDATE_INT, ['flags' => FILTER_THROW_ON_FAILURE]);
+    } catch (\Filter\FilterFailedException $e) {
+    }
+}));
+
+// Validation succeeds.
+var_dump(leakcheck(function () {
+    filter_var(15, FILTER_VALIDATE_INT, ['flags' => FILTER_THROW_ON_FAILURE]);
+}));
+?>
+--EXPECT--
+bool(true)
+bool(true)
diff --git a/ext/libxml/mime_sniff.c b/ext/libxml/mime_sniff.c
index 88c3b2d96451..b78a7a2d31bb 100644
--- a/ext/libxml/mime_sniff.c
+++ b/ext/libxml/mime_sniff.c
@@ -271,7 +271,7 @@ PHP_LIBXML_API zend_string *php_libxml_sniff_charset_from_string(const char *sta
 			/* 11.9.1. Set parameterValue to the result of collecting a sequence of code points that are not ';' */
 			size_t parameter_value_length = collect_a_sequence_of_code_points(start, end, is_not_semicolon);
 			parameter_value = zend_string_init(start, parameter_value_length, false);
-			start += parameter_name_length;
+			start += parameter_value_length;
 
 			/* 11.9.2. Remove trailing HTTP whitespace from parameterValue */
 			while (ZSTR_LEN(parameter_value) > 0 && is_http_whitespace(ZSTR_VAL(parameter_value)[ZSTR_LEN(parameter_value) - 1])) {
diff --git a/ext/session/mod_mm.c b/ext/session/mod_mm.c
index ff8664c981a0..70000f5ca848 100644
--- a/ext/session/mod_mm.c
+++ b/ext/session/mod_mm.c
@@ -481,7 +481,7 @@ PS_VALIDATE_SID_FUNC(mm)
 	PS_MM_DATA;
 
 	mm_lock(data->mm, MM_LOCK_RD);
-	zend_result ret = ps_mm_key_exists(data, key)
+	zend_result ret = ps_mm_key_exists(data, key);
 	mm_unlock(data->mm);
 	return ret;
 }