{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "PHP insecure error handling and state management",
    "tracking": {
      "current_release_date": "2026-10-21T14:56:09Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.2+build.155"
        }
      },
      "id": "VA-26-295-01",
      "initial_release_date": "2026-10-21T14:56:09Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-10-21T14:56:09Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "PHP insecurely handles multiple combinations of memory allocations and error conditions. These behaviors can allow a remote attacker to cause a denial of service or execute arbitrary code. Successful exploitation depends on a number of factors including the specific PHP application being targeted, the SAPI and web server, error handling and memory resource configuration, and platform or OS-level memory protections. Without significant analysis effort to prove otherwise, any application running on a vulnerable version of PHP should be considered vulnerable and exploitable.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "These vulnerabilities are addressed in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Additional details and mitigations can be found in this PHP advisory: [https://www.php.net/archive/2026.php#2026-10-21-5](https://www.php.net/archive/2026.php#2026-10-21-5) as well as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-295-01.json",
        "summary": "Vulnerability Advisory VA-26-295-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "PHP",
        "branches": [
          {
            "category": "product_name",
            "name": "php-src",
            "branches": [
              {
                "category": "product_version",
                "name": "8.2.35",
                "product": {
                  "name": "PHP php-src 8.2.35",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "8.3.36",
                "product": {
                  "name": "PHP php-src 8.3.36",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "8.4.27",
                "product": {
                  "name": "PHP php-src 8.4.27",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.12",
                "product": {
                  "name": "PHP php-src 8.5.12",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.2.35",
                "product": {
                  "name": "PHP php-src <8.2.35",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.3.36",
                "product": {
                  "name": "PHP php-src <8.3.36",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.4.27",
                "product": {
                  "name": "PHP php-src <8.4.27",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.5.12",
                "product": {
                  "name": "PHP php-src <8.5.12",
                  "product_id": "CSAFPID-0008"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "php-src",
            "branches": [
              {
                "category": "product_version",
                "name": "8.2.35",
                "product": {
                  "name": "PHP php-src 8.2.35",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "8.3.36",
                "product": {
                  "name": "PHP php-src 8.3.36",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version",
                "name": "8.4.27",
                "product": {
                  "name": "PHP php-src 8.4.27",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.12",
                "product": {
                  "name": "PHP php-src 8.5.12",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.2.35",
                "product": {
                  "name": "PHP php-src <8.2.35",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.3.36",
                "product": {
                  "name": "PHP php-src <8.3.36",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.4.27",
                "product": {
                  "name": "PHP php-src <8.4.27",
                  "product_id": "CSAFPID-0015"
                }
              },
              {
                "category": "product_version_range",
                "name": "<8.5.12",
                "product": {
                  "name": "PHP php-src <8.5.12",
                  "product_id": "CSAFPID-0016"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, the code before the allocation does not properly account for a early exit and leaves reachable request memory in an uninitialized or otherwise invalid state. The request shutdown procedure may then read or branch on the uninitialized memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Application-independent, complete remote code execution has been validated over HTTP against mod_php with default PHP input and memory limits and normal prefork workers. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2026-10-21T14:44:35Z/"
        }
      ],
      "title": "PHP multipart/form-data insecure out-of-memory error handling",
      "product_status": {
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ],
        "fixed": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "external",
          "summary": "www.php.net",
          "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
        },
        {
          "category": "external",
          "summary": "VA-26-295-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-295-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-109618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109618"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2026-10-21T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Calif.io",
          "names": [
            "Ryan"
          ]
        },
        {
          "organization": "Wiz"
        },
        {
          "organization": "OpenAI"
        },
        {
          "organization": "PHP",
          "names": [
            "Arnaud Le Blanc"
          ]
        },
        {
          "organization": "PHP",
          "names": [
            "Ilija Tovilo"
          ]
        },
        {
          "organization": "PHP",
          "names": [
            "Jakub Zelenka"
          ]
        },
        {
          "organization": "PHP",
          "names": [
            "Nora Dossche"
          ]
        }
      ],
      "release_date": "2026-10-21T00:00:00Z"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "PHP contains error handling, Session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, Session and error handling operations run before normal initialization of the next request. They can trust stale state left by the previous request before initialization has a chance to replace it, causing a use after free. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2026-10-21T14:44:47Z/"
        }
      ],
      "title": "PHP insecure state initialization use-after-free",
      "product_status": {
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ],
        "fixed": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "external",
          "summary": "www.php.net",
          "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
        },
        {
          "category": "external",
          "summary": "VA-26-295-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-295-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-109619",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109619"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2026-10-21T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2026-10-21T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Wiz"
        },
        {
          "organization": "Calif.io",
          "names": [
            "Ryan"
          ]
        },
        {
          "organization": "OpenAI"
        },
        {
          "organization": "PHP",
          "names": [
            "Arnaud Le Blanc"
          ]
        },
        {
          "organization": "PHP",
          "names": [
            "Ilija Tovilo"
          ]
        },
        {
          "organization": "PHP",
          "names": [
            "Jakub Zelenka"
          ]
        },
        {
          "organization": "PHP",
          "names": [
            "Nora Dossche"
          ]
        }
      ],
      "release_date": "2026-10-21T00:00:00Z"
    }
  ]
}