ALSA-2026:87071: PHP 8.4 security update addresses parser and memory flaws
Summary
ALSA-2026:87071: Flaws in PHP request parsing and SOAP handling can cause denial of service, memory corruption, remote code execution, or use-after-free. Affects php8.4 versions < 8.4.27-1.el10_2. Fixed in 8.4.27-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a scripting language in the AlmaLinux:10 ecosystem. It is embedded in HTML to generate dynamic web pages and provides built-in database integration for commercial and non-commercial database systems. PHP is also commonly used as a replacement for CGI scripts. This advisory covers PHP 8.4 and its listed extensions.
Vulnerability Detail
The flaws can cause denial of service, memory corruption with remote code execution, and use-after-free. The SOAP parser can enter unbounded recursion, while request parsing can trigger an out-of-memory bailout that leads to memory corruption and remote code execution. Fatal error handling can also retain stale request state, resulting in use-after-free. The advisory lists CVE-2026-91765, CVE-2026-109618, and CVE-2026-109619 for these issues.
How To Fix
Minimum fixed version
8.4.27-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to PHP endpoints that process untrusted requests, and limit exposure of SOAP functionality until the affected packages can be upgraded. No vendor workaround is supplied.
Conclusion
Upgrade affected PHP 8.4 packages to 8.4.27-1.el10_2. The advisory covers flaws in SOAP parsing, request parsing, and fatal error handling, with impacts ranging from denial of service to remote code execution. Check installed packages and dependency records to identify affected components. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for php8.4 →
FAQ
The advisory marks php8.4 and its listed extensions as affected before the fixed package version 8.4.27-1.el10_2.
The php8.4 flaws can enable denial of service, memory corruption leading to remote code execution, and use-after-free.
Upgrade affected php8.4 packages to the minimum fixed version, 8.4.27-1.el10_2.
Restrict access to PHP endpoints handling untrusted requests and limit exposure of SOAP functionality until php8.4 can be upgraded.
Inspect the installed package inventory or a manifest file like package-lock.json for php8.4. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
