This Red Hat Security Advisory (RHSA-2026:1409) addresses multiple vulnerabilities in the PHP 8.2 module used in Red Hat Enterprise Linux 9. The fixed issues include: CVE-2025-1735 (pgsql extension error handling), CVE-2025-6491 (NULL pointer dereference in SOAP extension), CVE-2025-1220 (hostname null character vulnerability), CVE-2025-14178 (heap-based buffer overflow in array_merge()), CVE-2025-14177 (information disclosure via getimagesize()), and CVE-2025-14180 (denial of service via invalid character sequence in PDO PostgreSQL prepared statements). Red Hat has released updated packages to remediate these vulnerabilities. The advisory rates the update as Important with a high severity level, but no CVSS scores are provided in the advisory itself. The update applies to multiple architectures and variants of Red Hat Enterprise Linux 9.

The vulnerabilities collectively could lead to various impacts including potential denial of service, information disclosure, memory corruption, and error handling failures in PHP applications running on affected Red Hat Enterprise Linux 9 systems. The issues affect core PHP extensions such as pgsql, SOAP, and PDO PostgreSQL, which are commonly used in web applications. The severity is rated high by Red Hat Product Security, indicating significant risk if unpatched.

Red Hat has released updated PHP 8.2 packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:1409 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended and effective mitigation. No additional vendor advisories indicate that no action is required or that these issues are already mitigated without patching.