CVE-2026-109619

Name of the Vulnerable Software and Affected Versions PHP (affected versions not specified)

Description PHP contains a use-after-free flaw where global state, error handling, object, and extension state may not be correctly reset or may be repopulated after being reset. This occurs because some states point to memory owned by a single request; if a fatal error interrupts the cleanup phase or if the process uses longjmp() for out-of-memory (OOM) errors to abort request handling, the global state may refer to memory after it has been freed. Subsequent requests may then read or branch on this stale state before it is fully initialized. An unauthenticated remote attacker can exploit this condition, specifically through the session.upload progress component or by sending a specially crafted POST request, to achieve remote code execution (RCE). This issue affects mod php and conditionally affects FPM through application-stage paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.