--- id: CVE-2026-6722 title: "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map\_without incrementing their referenc…" summary: "In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map\_without incrementing their referenc…" severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-416 - CWE-825 vendor: php product: php affected: - 'php >= 8.2.0, < 8.2.31' - 'php >= 8.3.0, < 8.3.31' - 'php >= 8.4.0, < 8.4.21' - 'php >= 8.5.0, < 8.5.6' patched: - php 8.5.6 published: '2026-05-10' updated: '2026-07-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6722' references: - url: 'https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5' label: security@php.net - url: 'https://access.redhat.com/errata/RHSA-2026:33449' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-6722' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2468560' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-6722' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6722' - url: 'https://access.redhat.com/errata/RHSA-2026:23388' - url: 'https://access.redhat.com/errata/RHSA-2026:22649' - url: 'https://access.redhat.com/errata/RHSA-2026:34354' - url: 'https://access.redhat.com/errata/RHSA-2026:22305' - url: 'https://access.redhat.com/errata/RHSA-2026:22142' - url: 'https://access.redhat.com/errata/RHSA-2026:22143' - url: 'https://access.redhat.com/errata/RHSA-2026:47200' tags: - nvd - csaf - vex - red-hat - score-dispute epss: 0.00894 epssPercentile: 0.58014 ingestedAt: '2026-07-01T15:50:58.827Z' scores: nvd: 9.8 vendor: 7.7 --- ## Overview In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. ## Affected - `php >= 8.2.0, < 8.2.31` - `php >= 8.3.0, < 8.3.31` - `php >= 8.4.0, < 8.4.21` - `php >= 8.5.0, < 8.5.6` ## Remediation Upgrade past the affected range: - `php 8.5.6` ## Vendor advisories - **RHSA-2026:23388** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23388) - **RHSA-2026:22649** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22649) - **RHSA-2026:34354** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34354) - **RHSA-2026:22305** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22305) - **RHSA-2026:22142** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22142) - **RHSA-2026:22143** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22143) - **RHSA-2026:33449** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33449) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json) - **RHSA-2026:47200** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47200)