Critical Security Update for PHP 8.4: Addressing Denial of Service and Memory Corruption Vulnerabilities
Summary
RLSA-2026:87071: Important: php8.4 security update. Affects php8.4 versions < 0:8.4.27-1.el10_2. Fixed in 0:8.4.27-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP 8.4 is an HTML-embedded scripting language widely used for developing dynamic web pages. It simplifies the process of writing database-enabled applications by offering built-in integration with various database management systems. However, like any software, PHP is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerabilities in PHP 8.4 stem from issues in its SOAP parser, memory management, and error handling. Specifically, a Denial of Service (DoS) can occur due to unbounded recursion in the SOAP parser, which can exhaust system resources. Additionally, an Out-Of-Memory (OOM) bailout during request parsing can lead to memory corruption and potential Remote Code Execution (RCE). Lastly, improper handling of fatal errors can result in stale request states, leading to use-after-free vulnerabilities. These issues can severely impact the stability and security of applications relying on PHP.
How To Fix
Minimum fixed version
0:8.4.27-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size and complexity of SOAP requests to mitigate the risk of Denial of Service attacks. However, this is not a substitute for applying the security update.
Conclusion
The vulnerabilities identified in PHP 8.4 pose significant risks to applications utilizing this scripting language. It is crucial for developers and system administrators to apply the necessary updates promptly to safeguard their systems against potential exploits.
See every vulnerability recorded for php8.4 →
FAQ
The main vulnerabilities include Denial of Service via unbounded recursion in the SOAP parser, memory corruption due to OOM bailouts, and use-after-free issues from improper error handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If an immediate update is not possible, consider implementing input size limits and monitoring your application for unusual behavior as a temporary workaround.
For more details, refer to the CVE pages linked in the vulnerability report, which provide in-depth information about the issues and their implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
