CVE-2026-6722

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its SOAP extension provides SoapServer and SoapClient, which decode SOAP XML messages into PHP values.

A Use After Free vulnerability (CVE-2026-6722) has been identified in the SOAP decoder of PHP's SOAP extension, which allows an attacker who controls a SOAP message, either a request to a SoapServer or a response to a SoapClient, to make PHP use memory after it has been freed by sending an apache:Map with duplicate keys and an href reference to the overwritten value, which can lead to remote code execution. PHP tracks this issue as GHSA-85c2-q967-79q5.

Per MITRE CWE-416: The product reuses or references memory after it has been freed.

This issue affects all versions of PHP before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, which includes every End-of-Life release line from PHP 5.6 through 8.1, each up to its final release.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/soap)
• Affected versions: <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Critical-severity vulnerability is found in the SOAP extension of all PHP versions before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21 and 8.5 before 8.5.6, including every End-of-Life release line from PHP 5.6 through 8.1, which never received the upstream fix. The PHP project scores it 9.5 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red).

SOAP messages can share one value between several places through id and href attributes. While decoding a message, PHP records each decoded value in a map, SOAP_GLOBAL(ref_map), keyed by its XML node, so that a later href to that node returns the same value. In the PHP source before the fix, the function that stores an entry reads:

static void soap_add_xml_ref(zval *data, xmlNodePtr node)
{
    if (SOAP_GLOBAL(ref_map)) {
        zend_hash_index_update(SOAP_GLOBAL(ref_map), (zend_ulong)node, data);
    }
} 

The map does not take a reference to the value, which is safe only as long as the decoded result keeps every value alive. The apache:Map SOAP type breaks that assumption: when a map contains the same key twice, decoding the second entry overwrites the first in the result and frees its value, while ref_map still points at it. An href to that node later in the same message then copies the dangling pointer into the result. According to the CVE record, PHP string allocations can reclaim the freed memory, so an attacker who controls the SOAP body can turn this into remote code execution.

Exploitation needs the SOAP extension and either a SoapServer endpoint that handles requests an attacker can send, or a SoapClient that reads responses from a server the attacker controls, under any server API. Applications that do not use the SOAP extension are not exposed.

The fix makes the map take a reference to every value it stores and gives the map a destructor, so the stored values are released when decoding ends:

static void soap_add_xml_ref(zval *data, xmlNodePtr node)
{
    if (SOAP_GLOBAL(ref_map)) {
        Z_TRY_ADDREF_P(data);
        zend_hash_index_update(SOAP_GLOBAL(ref_map), (zend_ulong)node, data);
    }
} 

HeroDevs' analysis notes one visible change on PHP 5.6: var_dump() of a decoded cyclic structure no longer marks one inner node as a reference (&), which matches the output of PHP 7.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not expose SoapServer endpoints to untrusted clients, and point SoapClient only at trusted servers over HTTPS. Disabling the SOAP extension removes the issue where SOAP is not used.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• brettgervasoni (finder)
• Ilija Tovilo (remediation)