CVE-2026-6722

The object deduplication mechanism in the SOAP extension stores pointers to PHP objects in a global map without incrementing the reference counter. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary results map, causing the original PHP object to be freed while its pointer (dangling pointer) remains in the map. A subsequent href reference to the freed node copies this invalid pointer to the result. Since PHP string allocations may reuse the freed memory area, an attacker controlling SOAP request content can trigger arbitrary code execution.

An unauthenticated attacker can achieve remote code execution (RCE) on a server processing malicious SOAP requests, which may lead to complete system compromise and threats to data confidentiality, integrity, and availability.

PHP should be updated as soon as possible to version 8.2.31, 8.3.31, 8.4.21, or 8.5.6 (depending on the branch in use). Until the patch is deployed, consider disabling the SOAP extension (if not required) or restricting access to SOAP endpoints at the firewall level.

PHP versions 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6 — affects installations with the SOAP extension enabled.