PT-2026-31818 · Unknown · Phpsessionrestore

Seunghyun Yoon + 2 · CVE-2026-5507 · Published 2026-04-09 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v4.0

4.1

Medium

Base vector

AV:L/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions versions prior to 2.3

Description When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.

Recommendations Update to version 2.3 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-5507

JLSEC-2026-733

Affected Products

Phpsessionrestore

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5507.json · Exploit
• https://github.com/wolfSSL/wolfssl/pull/10088 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5507 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5507 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5507 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5507 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-5507 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5507 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5507 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-733 · Vendor Advisory
• https://github.com/advisories/GHSA-f5fh-xmxq-55p9 · Note
• https://twitter.com/CVEnew/status/2042387944456273998 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044075179328913678 · Twitter Post
• https://t.me/msrcreports/4082 · Telegram Post
• https://twitter.com/infoflowcloud/status/2042389941175325126 · Twitter Post