Red Hat Security Advisory: php:8.2 security update

This advisory covers three security fixes in the php:8.2 module for Red Hat Enterprise Linux 9. CVE-2026-91765 addresses a denial of service vulnerability caused by unbounded recursion in the SOAP parser. CVE-2026-109618 involves an out-of-memory bailout during request parsing that can result in memory corruption and remote code execution. CVE-2026-109619 is a use-after-free vulnerability caused by fatal error handling retaining stale request state. Red Hat has released updated php:8.2 packages that remediate these issues. The advisory references Red Hat Bugzilla entries and provides links to update instructions.

Successful exploitation of these vulnerabilities could lead to denial of service conditions, memory corruption, and remote code execution on affected systems running the vulnerable php:8.2 module. The use-after-free vulnerability may allow attackers to execute arbitrary code. These issues impact the security and stability of PHP applications running on Red Hat Enterprise Linux 9. The advisory rates the overall security impact as Important.

Red Hat has released updated php:8.2 packages for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply the official Red Hat update as described in the advisory (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated beyond applying the update.