CVE-2026-7261

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its SOAP extension provides the SoapServer class, which can serve requests from a PHP class and, with SOAP_PERSISTENCE_SESSION, keep the handler object in the user's session between requests.

A Use After Free vulnerability (CVE-2026-7261) has been identified in SoapServer::handle(), part of PHP's SOAP extension, which allows a remote attacker who can send SOAP requests to a session-persisted SoapServer whose header handler faults to make PHP free the handler object while the session still refers to it, so that a later request uses freed memory. PHP tracks this issue as GHSA-m33r-qmcv-p97q.

Per MITRE CWE-416: The product reuses or references memory after it has been freed.

This issue affects all versions of PHP before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, which includes every release of the End-of-Life PHP 5.6, 7.0 through 7.4, 8.0 and 8.1 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/soap)
• Affected versions: <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the soap extension of all versions of PHP before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, including the End-of-Life PHP 5.6, 7.0 through 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:P/AU:Y/RE:M/U:Amber).

A SoapServer in class mode creates an object of the handler class for each request, or, with setPersistence(SOAP_PERSISTENCE_SESSION), keeps one object in the session and reuses it. Before calling the requested method, SoapServer::handle() passes any SOAP headers to methods of that object. When a header handler returns a SoapFault or throws an exception, the server sends the fault and releases the handler object. In PHP 7.4.33 that code reads:

php_output_discard();
soap_server_fault_ex(function, &h->retval, h);
efree(fn_name);
if (service->type == SOAP_CLASS && soap_obj) {zval_ptr_dtor(soap_obj);}
goto fail; 

The release does not check whether the object belongs to the session. Elsewhere in the same function the server releases the object only when persistence is not SOAP_PERSISTENCE_SESSION, but the fault paths do not: the code above runs both when a header handler returns a fault and when it throws an exception. With session persistence the session still holds a reference to the freed object, and the next request in that session uses it. The CVE record describes the result as memory corruption, information disclosure or process crashes.

Exploitation needs ext/soap and ext/session, and a SoapServer that uses setPersistence(SOAP_PERSISTENCE_SESSION) with a handler class that processes SOAP headers which can fault on attacker input. Any SAPI is affected. Servers that use the default request persistence, or that run in function mode, are not affected.

The fix, by Ilija Tovilo, releases the object on these paths only when it is not session-persisted:

if (service->type == SOAP_CLASS && soap_obj) {
    if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION) {
        zval_ptr_dtor(soap_obj);
    }
} 

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid SOAP_PERSISTENCE_SESSION for SOAP servers whose handler class processes SOAP headers, or use the default request persistence.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Ilia Alshanetsky (finder)
• Ilija Tovilo (remediation)