Red Hat Security Advisory: php8.4 security update

This advisory covers three security vulnerabilities in PHP 8.4 as packaged by Red Hat for Red Hat Enterprise Linux 10. CVE-2026-91765 is a denial of service vulnerability caused by unbounded recursion in the SOAP parser. CVE-2026-109618 involves an out-of-memory bailout during request parsing that can lead to memory corruption and potentially remote code execution. CVE-2026-109619 is a use-after-free vulnerability resulting from fatal error handling that retains stale request state. Red Hat has released updated php8.4 packages that address these vulnerabilities. The advisory includes detailed package versions and references for remediation.

Successful exploitation of CVE-2026-91765 can cause denial of service by crashing the PHP process. CVE-2026-109618 may allow an attacker to execute arbitrary code remotely due to memory corruption triggered by out-of-memory conditions during request parsing. CVE-2026-109619 can lead to use-after-free conditions, potentially enabling code execution or application instability. These vulnerabilities impact the security and stability of web applications relying on PHP 8.4 on affected Red Hat Enterprise Linux 10 systems.

Red Hat has released updated php8.4 packages that fix these vulnerabilities. Users should apply the official Red Hat update for php8.4 on Red Hat Enterprise Linux 10 as described in the advisory (RHSA-2026:87071) and the referenced article https://access.redhat.com/articles/11258. Applying this update is the recommended and effective mitigation. No additional workarounds or temporary fixes are indicated by the vendor.