Skip to content
fr Sign in
9.5 Critical

CVE-2026-6722 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP…

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

Affected products and versions

Product Affected versions Fixed in
PHP 8.5 earliest → < 8.5.6 8.5.6
PHP 8.4 earliest → < 8.4.21 8.4.21
PHP 8.3 earliest → < 8.3.31 8.3.31
PHP 8.2 earliest → < 8.2.31 8.2.31
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 8100020260604072603 earliest → < 8100020260604072603.f7998665 8100020260604072603.f7998665
Red Hat Enterprise Linux 9 Versions not published
Show the 2 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of PHP

The 103 CVEs of PHP →
CVE-2026-109619 RCE via stale global state 9.2 Critical CVE-2026-109618 RCE via OOM corruption 9.2 Critical CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a… 5.9 Medium CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so… 6.5 Medium
Track this CVE