CVE-2026-6722·PHP vulnerability
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
- Severity
- critical
- Software
- PHP
- Fixed in
- 8.5.6
- Published
- 2026-05-10
Affected versions
From: 8.5.0
Until: 8.5.6
Fixed in: 8.5.6
How to fix this CVE
Update PHP immediately to version 8.5.6 or later to patch the critical SOAP extension use-after-free vulnerability. If you are running PHP 8.2, 8.3, or 8.4, upgrade to 8.2.31, 8.3.31, or 8.4.21 respectively. If the SOAP extension is not required by your application, disable it entirely to eliminate attack surface.
sudo dnf update php php-soapDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST requests to SOAP endpoints containing XML with repeated apache:Map key elements followed by href references to previously freed nodes; look for patterns like: <soap:Body>.*<m:entry>.*<key>.*</key>.*</m:entry>.*<m:entry>.*<key>.*</key>.*</m:entry>.*<href.*>#.*</href>WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement a WAF rule to block SOAP POST requests containing duplicate keys within apache:Map structures; alternatively, restrict SOAP endpoint access to trusted internal networks only and monitor for XML payloads with multiple keys referencing the same identifier.How to check if you are affected
- Check the installed PHP version: php -v
- Verify if the SOAP extension is loaded: php -m | grep -i soap
- Review web server access logs for POST requests to SOAP endpoints with unusual XML containing duplicate apache:Map keys or href references
- Confirm the patch was applied: php -v should show 8.5.6, 8.4.21, 8.3.31, or 8.2.31 (or newer)
FAQ
What is CVE-2026-6722?
This is a critical use-after-free vulnerability in PHP's SOAP extension that occurs when processing malformed SOAP messages with duplicate keys in apache:Map nodes, allowing remote code execution through memory corruption.
Is CVE-2026-6722 being actively exploited?
No, CVE-2026-6722 is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available. However, the critical CVSS 9.8 rating warrants immediate patching.
What versions of PHP are affected by CVE-2026-6722?
PHP 8.5.0 through 8.5.5 are directly affected; however, vulnerable code also exists in 8.2.x (before 8.2.31), 8.3.x (before 8.3.31), and 8.4.x (before 8.4.21).
How do I check if my server is vulnerable to CVE-2026-6722?
Run `php -v` to get your version number and compare it against the fixed versions (8.5.6+, 8.4.21+, 8.3.31+, or 8.2.31+). If your version is lower and you have the SOAP extension enabled (`php -m | grep -i soap`), you are vulnerable.
Does Defensia detect CVE-2026-6722?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP is installed on a monitored server, CVE-2026-6722 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6722. Free for 1 server.
Get started free