CVE-2026-109618

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the uninitialized memory as valid, leading to memory corruption. An unauthenticated attacker can exploit this via crafted HTTP requests to achieve remote code execution against mod_php with default configuration, and against FPM through application-stage paths.

Rated Important. An unauthenticated remote attacker could corrupt engine memory and potentially execute arbitrary code, but reliable exploitation requires precise heap manipulation and timing. Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than mod_php. PHP-FPM workers exit on early initialization failures before reaching the corrupted structures, so remote code execution is difficult in practice and typically requires non-default behavior such as parsing a second request body during script execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.