SB20261021119 - Red Hat Enterprise Linux 9 update for the php:8.2 module
Published: October 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Uncontrolled Recursion (CVE-ID: CVE-2026-91765)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the SOAP XML parser's cleanup_xml_node() function when handling a SOAP request containing deeply nested XML elements. A remote attacker can send a specially crafted SOAP request to cause a denial of service.
2) Use-after-free (CVE-ID: CVE-2026-109618)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code as the web worker account.
The vulnerability exists due to improper handling of out-of-memory exceptions in PHP's request lifecycle when allocation failures trigger longjmp() while incompletely initialized request memory is reachable. A remote attacker can send specially crafted HTTP requests that exhaust memory, including multipart requests, to leave invalid memory state that is subsequently processed during request shutdown, leading to arbitrary code execution.
FPM susceptibility is supported by source analysis, but no complete FPM exploit has been demonstrated.
3) Use-after-free (CVE-ID: CVE-2026-109619)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose memory and execute arbitrary code with the web worker's privileges.
The vulnerability exists due to use-after-free in PHP's request lifecycle and persistent worker global state when operations access request-owned memory after it has been freed and before normal initialization of a subsequent request. A remote attacker can send crafted HTTP requests that leave stale state after interrupted operations or shutdown diagnostics, then trigger early error or session handling in another request processed by the same worker to disclose memory and, with a strategically crafted heap layout, execute arbitrary code.
Remediation
Install update from vendor's website.