Executive brief
A critical vulnerability has been identified in the PHP SOAP extension, which is commonly used by web applications to exchange structured information. An attacker can exploit this flaw by sending a specially crafted SOAP request to a vulnerable server, potentially allowing them to take full control of the system. This could lead to the theft of sensitive customer data, complete service disruption, or a total compromise of the underlying server infrastructure.
Technical details
A use-after-free (UAF) vulnerability exists in the PHP SOAP extension (ext-soap) due to improper reference counting in the object deduplication mechanism. When processing an 'apache:Map' node with duplicate keys, the extension overwrites entries in a temporary result map, freeing the original PHP object while maintaining a stale pointer in the global 'ref_map'. A subsequent 'href' reference to the freed node allows an attacker to copy this dangling pointer. By manipulating memory allocations (e.g., via PHP string allocations) to reclaim the freed region, a remote, unauthenticated attacker can achieve arbitrary code execution. The issue is resolved by ensuring reference counts are incremented before adding objects to the global map and using proper deallocators.
Affected products
- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-05-07: advisory: PHP Group published security advisory GHSA-85c2-q967-79q5
- 2026-05-10: disclosed: CVE-2026-6722 published to NVD
- 2026-05-10: patched: Fixes released in PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6