CVE-2026-109618

Name of the Vulnerable Software and Affected Versions PHP versions prior to 8.5.12 PHP versions prior to 8.4.27 PHP versions prior to 8.3.36 PHP versions prior to 8.2.35

Description PHP uses the longjmp() function to handle out-of-memory (OOM) errors by exiting the current context and aborting request handling. In certain scenarios, request memory may be temporarily reachable before it is fully initialized. If an allocation fails at this point, PHP may leave the request memory in an uninitialized or invalid state. The subsequent request cleanup procedure may then read or branch on this memory, which can be systematically triggered to achieve remote code execution (RCE). This issue specifically affects the session.upload progress component and can be exploited by sending a specially crafted POST request. In environments using Apache with mod php, this can lead to the execution of the system() function.

Recommendations Update to PHP version 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Disable the session.upload progress feature. Set memory limit to -1 and ensure the application cannot override this setting. Reduce the post max size value. On PHP 8.5, disable fatal error backtraces.