CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault
Fixed (Use-after-free after header parsing failure with SOAPPERSISTENCESESSION). (CVE-2026-7261)
Other sources
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.31-1~deb12u1Fixed in 8.2.32-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.23-1~deb13u1Fixed in 8.4.23-1 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7261?
CVE-2026-7261 has a high severity due to the potential for remote exploitation through a use-after-free vulnerability.
How do I fix CVE-2026-7261?
To fix CVE-2026-7261, upgrade your PHP version to 8.5.6 or later.
Which PHP versions are affected by CVE-2026-7261?
CVE-2026-7261 affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
What should I do if I cannot upgrade to a fixed version for CVE-2026-7261?
If upgrading is not possible, consider disabling the use of SoapServer or implementing additional security measures to mitigate the risk.
Are there any workarounds for CVE-2026-7261?
Currently, there are no known effective workarounds for CVE-2026-7261, and upgrading PHP is the recommended action.