Red Hat Security Advisory: php:8.3 security update

This advisory covers three security vulnerabilities in PHP 8.3 as packaged by Red Hat for Red Hat Enterprise Linux 9. CVE-2026-91765 is a denial of service vulnerability caused by unbounded recursion in the SOAP parser. CVE-2026-109618 involves an out-of-memory bailout during request parsing that can cause memory corruption and potentially remote code execution. CVE-2026-109619 is a use-after-free vulnerability resulting from fatal error handling retaining stale request state. Red Hat has released an update to address these issues and recommends applying the patch to affected systems.

Successful exploitation of CVE-2026-91765 can cause denial of service by crashing the PHP process. CVE-2026-109618 can lead to memory corruption and remote code execution, posing a critical risk. CVE-2026-109619 can result in use-after-free conditions, which may also be exploitable for code execution or cause application instability. These vulnerabilities affect PHP installations on Red Hat Enterprise Linux 9, potentially impacting web applications relying on PHP.

Red Hat has released an official security update for PHP 8.3 on Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated beyond applying the official patch.