CVE-2026-109619: Remote code execution in Bitnami libphp
Summary
CVE-2026-109619: Stale global state can expose freed request memory to later requests, enabling remote code execution and potentially compromising confidentiality, integrity, and availability. Affects libphp across 4 version ranges.
< 8.2.35
>= 8.3.0, < 8.3.36
>= 8.4.0, < 8.4.27
>= 8.5.0, < 8.5.12
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-109619 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libphp is a PHP package in the Bitnami ecosystem. PHP uses global state that can temporarily point into request memory while processing requests. If that state is not reset or is repopulated after reset, it can retain references to memory after that memory has been freed. The supplied record describes multiple strategies that can trigger this condition.
Vulnerability Detail
The stale global state can enable remote code execution, with potential effects on confidentiality, integrity, and availability. PHP global state may retain a pointer into request memory after that memory has been freed, or may be repopulated after a reset. Subsequent requests can read or branch on the stale state before it is fully initialized. The record identifies multiple triggering strategies but does not specify individual functions or components.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.2.358.2.35 -
>= 8.3.0, < 8.3.368.3.36 -
>= 8.4.0, < 8.4.278.4.27 -
>= 8.5.0, < 8.5.128.5.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to applications using libphp and limit their permissions while arranging an upgrade. This reduces exposure but does not correct stale global state; the record provides no documented workaround.
Conclusion
Upgrade libphp to the minimum fixed version for its release line: 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Restrict access and permissions if an immediate upgrade is not possible, recognizing that this is not a documented fix. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for libphp →
FAQ
libphp versions from 0 before 8.2.35, from 8.3.0 before 8.3.36, from 8.4.0 before 8.4.27, and from 8.5.0 before 8.5.12 are affected.
CVE-2026-109619 can allow remote code execution through stale global state that refers to freed request memory.
Upgrade libphp to at least 8.2.35, 8.3.36, 8.4.27, or 8.5.12, matching the release line in use.
Restrict access to applications using libphp and limit their permissions while arranging an upgrade; this is an AI-generated mitigation, not a documented workaround.
Inspect the application's manifest or SBOM for libphp and check its version against the affected ranges. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for libphp.
