PHP SoapServer Persistence Allows Memory Corruption

Summary

A bug in PHP's SoapServer allows a malicious SOAP request to potentially cause memory corruption, information disclosure, or crashes in affected systems. This affects PHP versions 8.2 through 8.5, and it's recommended to update to the latest version to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:14.04:LTS	canonical	php5	All versions
Ubuntu:Pro:16.04:LTS	canonical	php7.0	All versions
Ubuntu:Pro:18.04:LTS	canonical	php7.2	All versions
Ubuntu:Pro:20.04:LTS	canonical	php7.4	All versions
Ubuntu:22.04:LTS	canonical	php8.1	All versions
Ubuntu:24.04:LTS	canonical	php8.3	All versions
Ubuntu:25.10	canonical	php8.4	All versions
Ubuntu:26.04:LTS	canonical	php8.5	All versions

Original title

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted a...

Original description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

osv CVSS4.0 8.4

osv CVSS3.1 9.8

https://ubuntu.com/security/CVE-2026-7261 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-7261 Third Party Advisory
https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q Third Party Advisory