Executive brief
PHP is a widely used programming language for web development. A vulnerability in its SOAP (Simple Object Access Protocol) component could allow an attacker to cause system crashes, steal sensitive information, or potentially execute unauthorized code. This occurs when a web service is configured to remember user sessions and encounters a specific type of error during communication.
Technical details
A use-after-free vulnerability exists in PHP's SoapServer component (ext/soap) when SOAP_PERSISTENCE_SESSION is enabled. The root cause is a failure in soap.c to account for the persistence flag during error handling; specifically, when a handler function for a SOAP header node returns false or throws an exception, the handler object is prematurely freed while a pointer to it remains in session storage. When the session is subsequently written, the freed memory is accessed. This can be triggered by a remote, unauthenticated attacker sending a specially crafted SOAP request with a malicious header. The vulnerability can lead to memory corruption, process crashes, or information disclosure. Patches are available in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.
Affected products
- PHP Group PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6
Timeline
- 2026-05-07: advisory: Original GitHub advisory published by PHP Group
- 2026-05-10: disclosed: NVD publication date