Описание
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
A flaw was found in the PHP SoapServer component. When the server is configured to maintain session persistence, an error during a SOAP request can cause the system to incorrectly manage memory. This can lead to a "use-after-free" vulnerability, where the system attempts to use memory that has already been released. An attacker could exploit this to corrupt memory, potentially exposing sensitive information or causing the system to crash, resulting in a denial of service.
Отчет
This flaw only affects PHP users who have configured their runtime with the SOAP_PERSISTENCE_SESSION option which is not enabled by default. This flaw can lead to memory corruption, information disclosure, or service crashes. Normally, a SOAP server will only handle one SOAP request per PHP request, so it's unlikely that the attacker will be able to control the freed memory segment. Red Hat systems also employ address space layout randomization (ASLR) which makes accessing freed memory segments improbable.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | php | Affected | ||
| Red Hat Enterprise Linux 10 | php8.4 | Affected | ||
| Red Hat Enterprise Linux 6 | php | Out of support scope | ||
| Red Hat Enterprise Linux 7 | php | Affected | ||
| Red Hat Enterprise Linux 8 | php | Not affected | ||
| Red Hat Enterprise Linux 8 | php:8.2/php | Affected | ||
| Red Hat Enterprise Linux 9 | php:8.2/php | Affected | ||
| Red Hat Enterprise Linux 9 | php:8.3/php | Affected | ||
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2026:34354 | 01.07.2026 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2026:33449 | 30.06.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
SoapServer session-persisted object use-after-free via SOAP header fault
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before ...
SoapServer session-persisted object use-after-free via SOAP header fault
EPSS
5.6 Medium
CVSS3