USN-8734-1: PHP vulnerabilities
Ubuntu issued USN-8734-1 fixing three PHP denial-of-service flaws in SOAP, metaphone() and phar handling, including CVE-2026-7262 and CVE-2026-7568.
Ubuntu security notice USN-8734-1 addresses multiple PHP vulnerabilities. CVE-2026-7262 is a NULL pointer dereference in Apache map decoding in SOAP servers with a typemap configured; CVE-2026-7568 is a signed integer overflow in metaphone() causing an out-of-bounds read; and CVE-2026-7260 involves unbounded recursion from circular symbolic links in phar archives. All issues could allow remote attackers to cause denial-of-service conditions.
- Three PHP flaws enable remote denial of service.
- Affects SOAP servers with typemap, metaphone() function, and phar archive handling.
- Vendors
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-7260 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.*… | 5.4 | <1% | ||
CVE-2026-7568+1 related CVE | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c… | 6.3 group max | <1% |
From the original article
It was discovered that PHP incorrectly handled Apache map decoding in SOAP servers with a typemap configured. A remote attacker could use this issue to cause a NULL pointer dereference, resulting in a denial of service. (CVE-2026-7262) It was discovered that PHP incorrectly handled signed integer overflow in the metaphone() function.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.