2554177 – (CVE-2026-109619) CVE-2026-109619 php: fatal error handling retains stale request state leading to use-after-free

Bug 2554177 (CVE-2026-109619) - CVE-2026-109619 php: fatal error handling retains stale request state leading to use-after-free

Summary: CVE-2026-109619 php: fatal error handling retains stale request state leading...

Keywords:
Status:	NEW
Alias:	CVE-2026-109619
Deadline:	2026-10-21
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2026-10-16 15:59 UTC by OSIDB Bzimport
Modified:	2026-10-21 20:27 UTC (History)
CC List:	9 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2026:87070	None	None	None	2026-10-21 20:05:15 UTC
Red Hat Product Errata	RHSA-2026:87071	None	None	None	2026-10-21 20:04:00 UTC
Red Hat Product Errata	RHSA-2026:87072	None	None	None	2026-10-21 20:27:54 UTC
Red Hat Product Errata	RHSA-2026:87073	None	None	None	2026-10-21 20:22:43 UTC
Red Hat Product Errata	RHSA-2026:87079	None	None	None	2026-10-21 20:27:32 UTC
Red Hat Product Errata	RHSA-2026:87080	None	None	None	2026-10-21 15:45:15 UTC
Red Hat Product Errata	RHSA-2026:87151	None	None	None	2026-10-21 19:58:40 UTC

Description OSIDB Bzimport 2026-10-16 15:59:24 UTC

GHSA - https://github.com/php/php-src/security/advisories/GHSA-h37m-fxqh-w76h

Found a crash while investigating https://github.com/php/php-src/security/advisories/GHSA-626f-5vcj-8h2p. 

An OOM at the wrong time can leave zend_array s in a corrupted
state, and cause a zval_ptr_dtor() on uninitialized memory during shutdown.
This seems critical as this can be triggered during input parsing.

Details

_zend_hash_str_add_or_update_i() updates ht->nNumUsed before initializing the bucket,
and then allocates a zend_string for the key with zend_string_init() . If
zend_string_init() OOMs, the zend_array is left with one uninitialized bucket.

idx = ht->nNumUsed++;
ht->nNumOfElements++;
p = ht->arData + idx;
p->key = key = zend_string_init(str, len, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);

During shutdown, i_zval_ptr_dtor() is called on the uninitialized bucket, which might
contain data from user inputs

Comment 4 Jon Orris 2026-10-21 15:45:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87080 https://access.redhat.com/errata/RHSA-2026:87080

Comment 5 Jon Orris 2026-10-21 19:58:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87151 https://access.redhat.com/errata/RHSA-2026:87151

Comment 6 Jon Orris 2026-10-21 20:03:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:87071 https://access.redhat.com/errata/RHSA-2026:87071

Comment 7 Jon Orris 2026-10-21 20:05:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:87070 https://access.redhat.com/errata/RHSA-2026:87070

Comment 8 Jon Orris 2026-10-21 20:22:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87073 https://access.redhat.com/errata/RHSA-2026:87073

Comment 9 Jon Orris 2026-10-21 20:27:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87079 https://access.redhat.com/errata/RHSA-2026:87079

Comment 10 Jon Orris 2026-10-21 20:27:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87072 https://access.redhat.com/errata/RHSA-2026:87072

Note You need to log in before you can comment on or make changes to this bug.