RLSA-2026:87073: PHP security update addresses denial of service and memory safety flaws
Summary
RLSA-2026:87073: Remote requests can trigger service disruption, memory corruption, or use-after-free conditions, potentially enabling remote code execution. Affects libzip across 3 version ranges.
< 0:1.7.3-1.module+el8.10.0+1605+02e07af7
< 0:1.7.3-1.module+el8.10.0+1596+477f03f8
< 0:1.7.3-1.module+el8.10.0+1911+f499711e
Fixed in 0:1.7.3-1.module+el8.10.0+1605+02e07af7, 0:1.7.3-1.module+el8.10.0+1596+477f03f8 or 0:1.7.3-1.module+el8.10.0+1911+f499711e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a scripting language in the Rocky Linux:8 ecosystem. It embeds code in HTML and is commonly used with the Apache HTTP Server. The advisory covers PHP and related packages, including extensions and supporting components, distributed through the AppStream repository.
Vulnerability Detail
The PHP security update addresses denial of service, memory corruption, remote code execution, and use-after-free vulnerabilities. The SOAP parser can enter unbounded recursion, causing denial of service. An out-of-memory bailout during request parsing can lead to memory corruption and remote code execution, while fatal error handling can retain stale request state and cause use-after-free. The advisory associates these issues with CVE-2026-91765, CVE-2026-109618, and CVE-2026-109619.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libzip-
< 0:1.7.3-1.module+el8.10.0+1596+477f03f80:1.7.3-1.module+el8.10.0+1596+477f03f8 -
< 0:1.7.3-1.module+el8.10.0+1605+02e07af70:1.7.3-1.module+el8.10.0+1605+02e07af7 -
< 0:1.7.3-1.module+el8.10.0+1911+f499711e0:1.7.3-1.module+el8.10.0+1911+f499711e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
AI-generated workaround (not vendor-documented): For PHP applications that cannot yet be upgraded, restrict access to exposed services and limit untrusted requests that reach PHP request parsing or SOAP functionality. This is a temporary mitigation, not a substitute for installing the fixed package builds.
Conclusion
Upgrade each affected package to its listed fixed build; the minimum fixed build depends on the package and release line. The advisory identifies PHP and related Rocky Linux:8 packages as affected. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for libzip →
FAQ
The advisory lists affected ranges beginning at introduced version 0 for PHP and related packages; consult its package-specific fixed builds.
The PHP flaws can cause denial of service, memory corruption, remote code execution, and use-after-free conditions.
Upgrade each affected package to its listed fixed build; the minimum fixed version varies by package and release line.
Restrict access to exposed services and limit untrusted requests reaching PHP request parsing or SOAP functionality until upgrading.
Inspect the application’s manifest or SBOM for PHP and related packages. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for libzip.
