{"id":"SUSE-SU-2026:2091-1","summary":"Security update for php7","details":"This update for php7 fixes the following issues\n\n- CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).\n- CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).\n- CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of\n  service (bsc#1264774).\n- CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION\n  is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).\n- CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured\n  can lead to a denial of service (bsc#1264771).\n- CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability\n  of the PHPprocess (bsc#1264769).\n","modified":"2026-05-28T08:15:05.374345444Z","published":"2026-05-27T11:52:24Z","related":["CVE-2026-6722","CVE-2026-6735","CVE-2026-7258","CVE-2026-7261","CVE-2026-7262","CVE-2026-7568"],"upstream":["CVE-2026-6722","CVE-2026-6735","CVE-2026-7258","CVE-2026-7261","CVE-2026-7262","CVE-2026-7568"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262091-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264769"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264771"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264772"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264774"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264775"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6722"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-6735"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7258"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7261"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7262"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7568"}],"schema_version":"1.7.5"}