UpHeron
All vulnerabilities

Servers and applications

CVE-2026-7262

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP…

Severity
Low 2.9
Published
10 May 2026
Last changed
24 Jul 2026
Added to UpHeron
14 Oct 2026
Fixed in
8.2.31, 8.3.31, 8.4.21, 8.5.6
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 8.2.0 before 8.2.31
  • From 8.3.0 before 8.3.31
  • From 8.4.0 before 8.4.21
  • From 8.5.0 before 8.5.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-7262
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7262