{"id":"CVE-2026-6722","state":"PUBLISHED","title":"Use-After-Free in SOAP using Apache map","description":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","publishedAt":"2026-05-10T04:19:15.288Z","updatedAt":"2026-07-23T12:08:11.781Z","severity":{"score":9.5,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red","source":"php"},"assigner":"php","products":["PHP Group PHP"],"affected":[{"vendor":"PHP Group","product":"PHP","packageName":"soap","defaultStatus":"affected","versions":[{"version":"8.2.*","status":"affected","lessThan":"8.2.31","versionType":"semver"},{"version":"8.3.*","status":"affected","lessThan":"8.3.31","versionType":"semver"},{"version":"8.4.*","status":"affected","lessThan":"8.4.21","versionType":"semver"},{"version":"8.5.*","status":"affected","lessThan":"8.5.6","versionType":"semver"}]}],"references":["https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","https://access.redhat.com/security/cve/CVE-2026-6722","https://bugzilla.redhat.com/show_bug.cgi?id=2468560","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json","https://access.redhat.com/errata/RHSA-2026:23388","https://access.redhat.com/errata/RHSA-2026:22649","https://access.redhat.com/errata/RHSA-2026:34354","https://access.redhat.com/errata/RHSA-2026:22305","https://access.redhat.com/errata/RHSA-2026:22142","https://access.redhat.com/errata/RHSA-2026:22143","https://access.redhat.com/errata/RHSA-2026:33449"],"weaknesses":["CWE-416","CWE-825"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6722.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6722","state":"PUBLISHED","datePublished":"2026-05-10T04:19:15.288Z","dateUpdated":"2026-07-23T12:08:11.781Z","assignerShortName":"php","assignerOrgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","dateReserved":"2026-04-20T19:39:59.836Z"},"containers":{"cna":{"title":"Use-After-Free in SOAP using Apache map","descriptions":[{"lang":"en","value":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution."}],"affected":[{"vendor":"PHP Group","product":"PHP","packageName":"soap","defaultStatus":"affected","versions":[{"version":"8.2.*","status":"affected","lessThan":"8.2.31","versionType":"semver"},{"version":"8.3.*","status":"affected","lessThan":"8.3.31","versionType":"semver"},{"version":"8.4.*","status":"affected","lessThan":"8.4.21","versionType":"semver"},{"version":"8.5.*","status":"affected","lessThan":"8.5.6","versionType":"semver"}]}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.5,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","description":"CWE-416 Use After Free","type":"CWE"}]}],"providerMetadata":{"shortName":"php","orgId":"dd77f84a-d19a-4638-8c3d-a322d820ed2b","dateUpdated":"2026-05-10T04:19:15.288Z"},"datePublic":"2026-05-07T00:00:00.000Z","credits":[{"lang":"en","value":"brettgervasoni","type":"reporter"},{"lang":"en","value":"Ilija Tovilo","type":"remediation developer"},{"lang":"en","value":"Nora Dossche","type":"remediation reviewer"}],"source":{"advisory":"GHSA-85c2-q967-79q5","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-11T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-6722"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-12T03:55:18.668Z"}},{"title":"php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability","descriptions":[{"lang":"en","value":"A flaw was found in PHP's SOAP extension. This vulnerability allows a remote attacker to execute arbitrary code on the affected system. The issue stems from a use-after-free error in the object deduplication mechanism, which can be triggered by sending a specially crafted SOAP request. This allows an attacker to manipulate memory and achieve remote code execution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"php8.4","defaultStatus":"affected","versions":[{"version":"0:8.4.21-1.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"php","defaultStatus":"affected","versions":[{"version":"0:8.3.31-1.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"php:8.2","defaultStatus":"affected","versions":[{"version":"8100020260521052503.f7998665","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"php:7.4","defaultStatus":"affected","versions":[{"version":"8100020260604072603.f7998665","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php:8.3","defaultStatus":"affected","versions":[{"version":"9080020260521113736.9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php:8.2","defaultStatus":"affected","versions":[{"version":"9080020260521080715.9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php","defaultStatus":"affected","versions":[{"version":"0:8.0.30-6.el9_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"php","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-6722","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468560","name":"RHBZ#2468560","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23388","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22649","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34354","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22305","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22142","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22143","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33449","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-825","description":"Expired Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-23T12:08:11.781Z"},"datePublic":"2026-05-10T04:19:15.288Z","solutions":[{"lang":"en","value":"RHSA-2026:23388: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:22649: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:34354: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:22305: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:22142: Red Hat Enterprise Linux AppStream (v. 9)"},{"lang":"en","value":"RHSA-2026:22143: Red Hat Enterprise Linux AppStream (v. 9)"},{"lang":"en","value":"RHSA-2026:33449: Red Hat Enterprise Linux AppStream (v. 9)"}],"timeline":[{"lang":"en","time":"2026-05-10T05:00:46.220Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-10T04:19:15.288Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}