A flaw was found in php before versions 7.2.12 and 7.1.24. When a specifically structured cyclic reference is created the garbage collector fails to detect it which causes the references to never be freed. This leads to a memory leak. References: https://bugs.php.net/bug.php?id=76946 https://secure.php.net/ChangeLog-7.php Upstream Patch: http://git.php.net/?p=php-src.git;a=commit;h=83e2b9e2202da6cc25bdaac67a58022b90be88e7
Created php tracking bugs for this issue: Affects: fedora-all [bug 1649482]
I think this qualifies more as "normal" bug than a security issue: overall, the chances of this happening are rare, I doubt that this is really suitable to be triggered remotely (to a degree where this becomes a real problem), and if you can execute PHP code, you can do much worse than this. Thus, from a security perspective, I'll close this as NOTABUG.