Описание
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the uninitialized memory as valid, leading to memory corruption. An unauthenticated attacker can exploit this via crafted HTTP requests to achieve remote code execution against mod_php with default configuration, and against FPM through application-stage paths.
Отчет
Rated Important. An unauthenticated remote attacker could corrupt engine memory and potentially execute arbitrary code, but reliable exploitation requires precise heap manipulation and timing. Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than mod_php. PHP-FPM workers exit on early initialization failures before reaching the corrupted structures, so remote code execution is difficult in practice and typically requires non-default behavior such as parsing a second request body during script execution.
Меры по смягчению последствий
See the security bulletin for a detailed mitigation procedure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | php | Out of support scope | ||
| Red Hat Enterprise Linux 7 | php | Not affected | ||
| Red Hat Enterprise Linux 9 | php:8.4/php | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Not affected | ||
| Red Hat OpenShift Dev Spaces | devspaces/code-rhel9 | Not affected | ||
| Red Hat OpenShift Dev Spaces | devspaces/udi-rhel9 | Affected | ||
| Red Hat Enterprise Linux 10 | php | Fixed | RHSA-2026:87070 | 21.10.2026 |
| Red Hat Enterprise Linux 10 | php8.4 | Fixed | RHSA-2026:87071 | 21.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | php | Fixed | RHSA-2026:88561 | 23.10.2026 |
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2026:87073 | 21.10.2026 |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current ...
Уязвимость функции longjmp() компонента session.upload_progress ядра интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
8.1 High
CVSS3