Bug 2468561 (CVE-2026-7258)

Summary:	CVE-2026-7258 PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jkoehler, lphiri, rhel-process-autobot, sdawley, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in PHP. Some functions, including `urldecode()`, incorrectly pass signed characters to character type (ctype) functions. On certain systems, this can lead to accessing memory with a negative offset. This vulnerability can be exploited by an attacker to trigger a denial of service (DoS), making the affected PHP application or system unavailable.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-10 05:01:11 UTC

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

Comment 2 errata-xmlrpc 2026-06-01 02:47:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:22143 https://access.redhat.com/errata/RHSA-2026:22143

Comment 3 errata-xmlrpc 2026-06-01 03:05:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:22142 https://access.redhat.com/errata/RHSA-2026:22142

Comment 4 errata-xmlrpc 2026-06-01 10:53:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:22305 https://access.redhat.com/errata/RHSA-2026:22305

Comment 5 errata-xmlrpc 2026-06-02 22:07:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:22649 https://access.redhat.com/errata/RHSA-2026:22649

Comment 6 errata-xmlrpc 2026-06-04 15:53:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:23388 https://access.redhat.com/errata/RHSA-2026:23388

Comment 7 errata-xmlrpc 2026-06-30 10:46:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:33449 https://access.redhat.com/errata/RHSA-2026:33449

Comment 8 errata-xmlrpc 2026-07-01 16:49:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:34354 https://access.redhat.com/errata/RHSA-2026:34354