Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2026-7261: PHP SoapServer persistence can cause memory corruption or crashes
CVE-2026-7261
Summary
PHP versions 8.2 to 8.5 have a bug that can cause memory corruption or crashes when handling SOAP requests. This can lead to sensitive information being leaked or the system becoming unstable. To fix this, update PHP to the latest version.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| php | php |
>= 8.2.0, < 8.2.31 >= 8.3.0, < 8.3.31 >= 8.4.0, < 8.4.21 >= 8.5.0, < 8.5.6 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* |
Original title
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted a...
Original description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
nvd CVSS4.0
6.3
Vulnerability type
CWE-416
Use After Free
Published: 10 May 2026 · Updated: 28 May 2026 · First seen: 10 May 2026