Php · Php · CVE-2026-7261
**Name of the Vulnerable Software and Affected Versions**
PHP versions 8.2.0 through 8.2.30
PHP versions 8.3.0 through 8.3.30
PHP versions 8.4.0 through 8.4.20
PHP versions 8.5.0 through 8.5.5
**Description**
When SoapServer is configured with `SOAP PERSISTENCE SESSION`, the handler object is persisted across requests using session storage. If a SOAP request results in an error, the persistence is handled incorrectly, causing the object to be freed while a pointer to it remains. This leads to a use-after-free condition, which is a situation where a program continues to use a pointer after it has been freed, potentially resulting in memory corruption, information disclosure, or process crashes.
**Recommendations**
Update PHP version 8.2.x to 8.2.31
Update PHP version 8.3.x to 8.3.31
Update PHP version 8.4.x to 8.4.21
Update PHP version 8.5.x to 8.5.6