Two memory flaws in PHP core: request memory is read after it is freed

What happens

CVE-2026-109618: on an out-of-memory error PHP uses longjmp() to leave the current context. Some contexts do not account for that, so request memory is left uninitialised, and the cleanup step reads or branches on it.

CVE-2026-109619: PHP's global state sometimes points into request memory. When it is not reset correctly, the next request reads stale state from freed memory.

Both are flaws in the engine itself, not in an extension, and NVD rates them CVSS 9.2. A malformed request can lead to code execution.

The path in

• Any request that reaches PHP. The flaw sits in request cleanup, so no login and no special route is needed to reach it.
• One path named so far: session.upload_progress. Independent analysis points at the php_session_rfc1867_callback handler in ext/session/session.c. That is one path, not the only one.
• Shared hosting: one FPM pool serves several sites, so one site's request can be the malformed request for another site in the same pool.

Which PHP

• The distro's build: the php8.x-fpm package from the distro repository or a PPA. Patch with apt when the vendor ships the fix.
• A container build: the php:8.x-fpm image or your own. The image must be rebuilt; apt upgrade on the host never reaches PHP inside the image.
• An application image with its own PHP: php -v on the host says nothing about it.

Running is not installed

• FPM loads code at start-up: after the package upgrade, kill -USR2 the master process (a graceful reload) or restart the service. An upgraded package that was not reloaded still runs the old code.
• Read configuration from the right SAPI too: CLI and FPM read different php.ini sets, and FPM is what serves requests.

Affected and fixed versions

Original description (PHP · CVE-2026-109618): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and …

Original description (PHP · CVE-2026-109619): PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and …

What to do

• Upgrade to the fixed release for your line — the table above lists them, read from the data's affected ranges.
• Lines out of support (8.1 and older) get no fix from the project: move to a supported line, or apply the mitigation below.
• Mitigation: set session.upload_progress.enabled = Off through a drop-in file in conf.d — never by editing php.ini, so a package upgrade cannot revert it — then reload FPM.
• This is a mitigation, not a fix: public analysis suggests it closes one of two paths, so do not record a host as patched because the flag is off.

Check yourself

php -v

Tells you: the PHP version of the CLI SAPI

php-fpm -i | grep -i upload_progress

Tells you: the value FPM actually uses; Off => Off means it is off

grep -r session.upload_progress /etc/php

Tells you: the configuration line; a line commented with ; still means on, because the compiled default is On

php -i | grep -i 'Loaded Configuration File'

Tells you: (none) means compiled defaults apply, and that default is On

systemctl list-units 'php*-fpm'

Tells you: the PHP lines running on this machine

docker exec <container> php -v

Tells you: the version inside the image, not on the host

Sources

• CVE-2026-109618 — PHP
• CVE-2026-109619 — PHP
• php.net releases
• CVE-2026-109619

Written from the original advisory and the vendor's documentation; versions come from the site's data, updated 2026-11-10. Where they differ, the original advisory wins.