جزئیات آسیب‌پذیری
CVE-2026-6722
Use-After-Free in SOAP using Apache map
شرح رسمی (انگلیسی)
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.5بحرانی | 4.0 | CVEProject cvelistV5 (CNA) (php) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/RE:M/U:Red |
| 7.7بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| PHP Group | PHP | 8.2.* ≤ v < 8.2.31 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.3.* ≤ v < 8.3.31 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.4.* ≤ v < 8.4.21 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.5.* ≤ v < 8.5.6 | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 7 | همه | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۱- https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-6722 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2468560 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6722.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:23388 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22649 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34354 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22305 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22142 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22143 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33449 vendor-advisoryx_refsource_REDHAT
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۲/۲۰
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۵/۰۱
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- php
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-416Use After Free
- CWE-825Expired Pointer Dereference