CVE-2026-109618

Name of the Vulnerable Software and Affected Versions PHP versions prior to 8.5.12 PHP versions prior to 8.4.27 PHP versions prior to 8.3.36 PHP versions prior to 8.2.35

Description A use-after-free memory corruption issue exists in the PHP interpreter core, specifically within the session.upload progress component. The flaw occurs during request parsing when PHP records state as ready before all memory allocations are complete. If an allocation fails due to out-of-memory (OOM) errors, the longjmp() function is used to abort the request, but some contexts fail to properly roll back the incomplete state, leaving request memory uninitialized. Subsequent cleanup procedures may read or branch on this uninitialized memory. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP POST requests to achieve remote code execution (RCE). Real-world exploitation has been observed against systems using Apache mod php, where attackers used a four-stage HTTP chain involving memory exhaustion and information disclosure via the PHPSESSID header to bypass ASLR and execute shell commands such as /bin/sh.

Recommendations Update to PHP version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 respectively. Disable the session.upload progress feature. Set memory limit to -1 and ensure the application cannot override this setting. Reduce the post max size value. On PHP 8.5, disable fatal error backtraces.