CVE-2026-7261

A flaw was found in the PHP SoapServer component. When the server is configured to maintain session persistence, an error during a SOAP request can cause the system to incorrectly manage memory. This can lead to a "use-after-free" vulnerability, where the system attempts to use memory that has already been released. An attacker could exploit this to corrupt memory, potentially exposing sensitive information or causing the system to crash, resulting in a denial of service.

This flaw only affects PHP users who have configured their runtime with the SOAP_PERSISTENCE_SESSION option which is not enabled by default. This flaw can lead to memory corruption, information disclosure, or service crashes. Normally, a SOAP server will only handle one SOAP request per PHP request, so it's unlikely that the attacker will be able to control the freed memory segment. Red Hat systems also employ address space layout randomization (ASLR) which makes accessing freed memory segments improbable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.