CVE-2026-6722: PHP SOAP Use-After-Free via apache:Map Duplicate Keys
CVE-2026-6722 is a use-after-free (CWE-416) in the PHP SOAP extension, where object pointers are kept in a global map without reference counting. Duplicate keys in an apache:Map node can leave a stale pointer to a freed object, and the record describes possible remote code execution. The record reports a CVSS 3.1 base score of 9.8 and no KEV listing.
Overview
CVE-2026-6722 is a use-after-free weakness (CWE-416) in the SOAP extension of PHP. According to the record, the extension stores pointers to PHP objects in a global map without increasing their reference counts. Duplicate keys in an apache:Map node can cause an object to be freed while a stale pointer remains in use.
Impact
- NVD scores the issue 9.8 (critical) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- The PHP CNA scores it 9.5 under CVSS 4.0.
- The record states that an attacker who controls the SOAP request body could achieve remote code execution. This is the record's claim and was not independently verified here.
- SSVC lists technical impact as total.
Affected products and versions
- PHP 8.2 series, from 8.2.0 before 8.2.31.
- PHP 8.3 series, from 8.3.0 before 8.3.31.
- PHP 8.4 series, from 8.4.0 before 8.4.21.
- PHP 8.5 series, from 8.5.0 before 8.5.6.
The record does not list fixed versions explicitly. The upper bounds above are the first versions outside the stated ranges. The PHP security advisory is the reference to consult for authoritative details.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record. No confirmed active exploitation appears in the sources consulted. SSVC marks exploitation as none and automatable as no. The EPSS probability is 0.00894, with percentile 0.59135.
Remediation and mitigation
- Upgrade PHP to the first release outside the affected range for your branch: 8.2.31 or later, 8.3.31 or later, 8.4.21 or later, or 8.5.6 or later.
- If you use a distribution build, check whether the vendor has backported the fix. Red Hat errata referencing this CVE appear in the sources, see the Red Hat CVE page.
- Limit exposure of SOAP endpoints to trusted clients where possible, and disable the SOAP extension where it is not needed.
Detection guidance
- Inventory PHP versions and whether the SOAP extension is enabled on hosts and containers.
- Review web and application logs for unusual or malformed SOAP requests, and for crashes or unexpected restarts of PHP workers.
Limitations of the available information
The record provides no explicit fixed-version statement, no technical details beyond the description, and no independent confirmation of the exploitability claim. Scores come from different CVSS versions and providers, and a 7.7 score under CVSS 3.1 from an unnamed provider is also listed.
Frequently asked questions
Is CVE-2026-6722 being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. SSVC marks exploitation as none.
Which PHP versions are affected?
According to the record, PHP 8.2 from 8.2.0 before 8.2.31, PHP 8.3 from 8.3.0 before 8.3.31, PHP 8.4 from 8.4.0 before 8.4.21, and PHP 8.5 from 8.5.0 before 8.5.6.
What should I do first?
Check whether you run PHP with the SOAP extension in those ranges, and upgrade to 8.2.31, 8.3.31, 8.4.21, or 8.5.6 or later for your branch, or apply your distribution vendor's fix.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.