UpHeron
All vulnerabilities

Servers and applications

CVE-2026-6722

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP…

Severity
Critical 9.5
Published
10 May 2026
Last changed
24 Jul 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.2.31, 8.3.31, 8.4.21, 8.5.6
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.2.0 before 8.2.31
  • From 8.3.0 before 8.3.31
  • From 8.4.0 before 8.4.21
  • From 8.5.0 before 8.5.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-6722
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6722