CVE-2026-7262

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its soap extension implements SOAP clients and servers (SoapClient and SoapServer) and decodes incoming SOAP XML into PHP values.

A Denial of Service (DoS) vulnerability (CVE-2026-7262) has been identified in the apache:Map decoder of PHP's soap extension, which allows a remote, unauthenticated attacker to crash the PHP process by sending a SOAP message with a map item that has a key but no value to a SOAP server configured with a type map. PHP tracks this issue as GHSA-hmxp-6pc4-f3vv.

Per MITRE CWE-476: The product dereferences a pointer that it expects to be valid but is NULL.

This issue affects all versions of PHP before 8.2.31, PHP 8.3 before 8.3.31, PHP 8.4 before 8.4.21 and PHP 8.5 before 8.5.6, which includes the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines through their final releases.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/soap, to_zval_map())
• Affected versions: <8.2.31, >=8.3.0 <8.3.31, >=8.4.0 <8.4.21, >=8.5.0 <8.5.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Low-severity vulnerability is found in the soap extension of all PHP versions before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21 and 8.5 before 8.5.6, including the End-of-Life PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 2.9 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/RE:M/U:Amber).

An apache:Map is a SOAP encoding for associative arrays: a list of item elements, each holding a key and a value. PHP decodes it in to_zval_map(), which looks up both child elements and should reject an item that lacks either one. In PHP 7.4.33, the check after the value lookup tests xmlKey a second time instead of xmlValue:

xmlKey = get_node(item->children, "key");
if (!xmlKey) {
    soap_error0(E_ERROR, "Encoding: Can't decode apache map, missing key");
}

xmlValue = get_node(item->children, "value");
if (!xmlKey) {
    soap_error0(E_ERROR, "Encoding: Can't decode apache map, missing value");
} 

When the value element is missing, xmlValue is NULL and the decoder carries on, passing it to master_to_zval(). When a type map is configured, the conversion code reads data->properties from that node to look up its xsi:type attribute, dereferencing the NULL pointer and crashing the PHP process with a segmentation fault.

Exploitation needs a PHP application using the soap extension with a typemap option, under any SAPI. The CVE record and the advisory describe a SoapServer that accepts requests from the attacker, where no authentication or user interaction is needed. HeroDevs' analysis for PHP 5.6 and 7.2 also lists a SoapClient that decodes a response from an attacker-controlled server.

The fix tests the right variable, so an item without a value raises a SOAP fault instead of crashing:

xmlValue = get_node(item->children, "value");
if (!xmlValue) {
    soap_error0(E_ERROR, "Encoding: Can't decode apache map, missing value");
} 

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, remove the typemap option from SOAP servers that accept requests from untrusted clients, or disable the soap extension where it is not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Ilia Alshanetsky (finder)
• Ilija Tovilo (remediation)