CVE-2026-6722 Details
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
A use-after-free vulnerability has been identified in the PHP SOAP extension, specifically in versions 8.2.* prior to 8.2.31, 8.3.* prior to 8.3.31, 8.4.* prior to 8.4.21, and 8.5.* prior to 8.5.6. The issue arises in the object deduplication mechanism, which improperly manages object references by storing pointers in a global map without increasing their reference counts. This flaw can be exploited when an 'apache:Map' node contains duplicate keys, allowing an attacker to overwrite existing entries and create dangling pointers to freed PHP objects. By manipulating the SOAP request, this vulnerability can be leveraged to execute arbitrary code remotely.
Users can upgrade to PHP versions 8.2.31, 8.3.31, 8.4.21, or 8.5.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:22142 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:22143 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:22305 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:22649 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:23388 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:33449 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:34354 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-6722 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2468560 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json | redhat-SADP | |
| https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-825 | Expired Pointer Dereference | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| php php | >= 8.2.0, < 8.2.31 >= 8.3.0, < 8.3.31 >= 8.4.0, < 8.4.21 >= 8.5.0, < 8.5.6 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 10, 2026 | New CVE Received | [email protected] |