Bug 2554177 (CVE-2026-109619)

Summary:	CVE-2026-109619 php: fatal error handling retains stale request state leading to use-after-free
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	eric.eisenhart, hgelfenbeyn, lehman, lucas.blenkhorn, oleksii.molchanov.pe, rhel-process-autobot, sdawley, security-response-team, tdamato, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is reset. If PHP catches the failure and continues cleanup, or reuses the persistent worker for a subsequent request, a later operation may act on the stale state after its underlying memory has been released. An unauthenticated attacker can exploit this to achieve use-after-free and remote code execution against mod_php. FPM is conditionally affected through application-stage paths.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-21

Description OSIDB Bzimport 2026-10-16 15:59:24 UTC

GHSA - https://github.com/php/php-src/security/advisories/GHSA-h37m-fxqh-w76h

Found a crash while investigating https://github.com/php/php-src/security/advisories/GHSA-626f-5vcj-8h2p. 

An OOM at the wrong time can leave zend_array s in a corrupted
state, and cause a zval_ptr_dtor() on uninitialized memory during shutdown.
This seems critical as this can be triggered during input parsing.

Details

_zend_hash_str_add_or_update_i() updates ht->nNumUsed before initializing the bucket,
and then allocates a zend_string for the key with zend_string_init() . If
zend_string_init() OOMs, the zend_array is left with one uninitialized bucket.

idx = ht->nNumUsed++;
ht->nNumOfElements++;
p = ht->arData + idx;
p->key = key = zend_string_init(str, len, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);

During shutdown, i_zval_ptr_dtor() is called on the uninitialized bucket, which might
contain data from user inputs

Comment 4 Jon Orris 2026-10-21 15:45:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87080 https://access.redhat.com/errata/RHSA-2026:87080

Comment 5 Jon Orris 2026-10-21 19:58:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87151 https://access.redhat.com/errata/RHSA-2026:87151

Comment 6 Jon Orris 2026-10-21 20:03:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:87071 https://access.redhat.com/errata/RHSA-2026:87071

Comment 7 Jon Orris 2026-10-21 20:05:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:87070 https://access.redhat.com/errata/RHSA-2026:87070

Comment 8 Jon Orris 2026-10-21 20:22:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87073 https://access.redhat.com/errata/RHSA-2026:87073

Comment 9 Jon Orris 2026-10-21 20:27:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87079 https://access.redhat.com/errata/RHSA-2026:87079

Comment 10 Jon Orris 2026-10-21 20:27:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87072 https://access.redhat.com/errata/RHSA-2026:87072

Comment 11 Oleksii Molchanov 2026-10-22 22:47:31 UTC

Note for RHEL 7 users: the bulletin RHSB-2026-013 (updated on
22 Oct 2026, 15:47 UTC) lists RHEL 7 as "Only affected by
CVE-2026-109619 — In a default configuration, the version of PHP in
use is vulnerable". The CSAF VEX file for this CVE, generated earlier
on 22 Oct (05:04 UTC), still lists red_hat_enterprise_linux_7:php as
known_not_affected, so the two sources currently disagree:

https://access.redhat.com/security/vulnerabilities/RHSB-2026-013
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109619.json

The known path on php-5.4.16 is session upload progress, which is
enabled by default. As the upstream advisory describes, setting
session.upload_progress.enabled = 0 in php.ini (not with ini_set())
and restarting every process that runs PHP closes that path.

For systems that will not get a vendor update for php, for example
CentOS 7, I have published an unofficial backport of the upstream
minimal mitigation (php-src 712e60f9ed) as a rebuilt vendor package,
php-5.4.16-48.el7.php2shell.1. On PHP 5.4 it also disables session
upload progress in the code. It is not affiliated with or supported
by Red Hat:

https://www.openwall.com/lists/oss-security/2026/10/22/27
https://github.com/alvm/php2shell-eol-backport

Comment 12 Jon Orris 2026-10-23 02:29:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:88533 https://access.redhat.com/errata/RHSA-2026:88533

Comment 13 Jon Orris 2026-10-23 02:37:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:88532 https://access.redhat.com/errata/RHSA-2026:88532

Comment 14 Jon Orris 2026-10-23 09:43:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:88565 https://access.redhat.com/errata/RHSA-2026:88565

Comment 15 Jon Orris 2026-10-23 09:58:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:88561 https://access.redhat.com/errata/RHSA-2026:88561

Comment 16 Jon Orris 2026-10-23 11:41:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:88659 https://access.redhat.com/errata/RHSA-2026:88659

Comment 17 Jon Orris 2026-10-23 13:51:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:88693 https://access.redhat.com/errata/RHSA-2026:88693

Comment 18 Jon Orris 2026-10-23 14:49:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:88725 https://access.redhat.com/errata/RHSA-2026:88725

Comment 19 Jon Orris 2026-10-23 14:51:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:88720 https://access.redhat.com/errata/RHSA-2026:88720

Comment 20 Jon Orris 2026-10-23 19:21:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:88834 https://access.redhat.com/errata/RHSA-2026:88834

Comment 21 Jon Orris 2026-10-23 19:34:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:88835 https://access.redhat.com/errata/RHSA-2026:88835