CVE-2026-6722 is a critical (CVSS 9.8) use after free in PHP's SOAP extension. A crafted SOAP request body can lead to remote code execution. It is fixed in PHP 8.2.31, 8.3.31, 8.4.21 and 8.5.6. Upgrade, or disable the SOAP extension where you do not need it.
What's affected
- Product: PHP, the ext-soap extension.
- Affected versions: 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6.
- Fixed versions: 8.2.31, 8.3.31, 8.4.21 and 8.5.6.
- Weaknesses: CWE-416 use after free and CWE-825 expired pointer dereference.
- Severity: CVSS 3.1 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The php-src advisory itself is rated High. - Distribution packages: the record lists several Red Hat errata (RHSA-2026:22142, 22143, 22305, 22649 and 23388). Check your vendor's advisory for backported builds.
How to check if you're exposed
Check the PHP version and whether the SOAP extension is loaded, for the command line and for the web server separately, since they can use different builds:
php -v
php -m | grep -i soap
php -r 'echo extension_loaded("soap") ? "soap loaded\n" : "no soap\n";'
For web requests, put a temporary phpinfo page in a protected location, or use your hosting panel, and look for the soap section. Remove the page afterwards.
Then search your code for SoapServer. The flaw is in processing a request body, so it matters most where your code runs a SOAP server or client that handles data from outside. Distribution builds may carry the fix under an older version number, so compare against the vendor advisory.
What to do now
- List every PHP runtime, including containers, CLI tools and web servers.
- Upgrade to 8.2.31, 8.3.31, 8.4.21 or 8.5.6 or later, or install the vendor package that lists CVE-2026-6722 as fixed.
- Restart PHP-FPM, Apache or whatever serves PHP so the new binary loads.
- If you do not use SOAP, disable the extension.
- If you run a SOAP service, limit who can reach it and the size of request bodies until it is patched.
- Rebuild images that pin a PHP base image.
Why it matters
The php-src advisory explains the mechanism at a high level. The SOAP extension deduplicates objects in a request using a map keyed by XML node, and it stores pointers to PHP objects there without raising their reference counts. A crafted request can cause an entry to be overwritten and the original object freed while the pointer stays in the map. A later reference then copies the dangling pointer. Because PHP strings can reuse the freed memory, the advisory says an attacker who controls the request body can turn this into code execution.
The attacker needs no account, only the ability to send a request to a SOAP endpoint. That is why the score is 9.8 even though many PHP sites do not use SOAP. Memory safety bugs in a language runtime are fixed in the runtime, so the right move is the upgrade, not application changes. The CISA KEV flag is false and no exploitation is reported.
Try it yourself
This walkthrough shows a scan that finds a runtime with a known fixed release and points to the version to move to.
Click through it at your own pace, or open it full screen.
Quick check
I do not use SOAP. Am I affected?
Only if the extension is loaded and reachable through code that processes SOAP requests. Check with php -m and by searching for SoapServer, and disable it if unused.
Does my distribution version number matter?
Yes. Vendors backport fixes, so compare against the vendor advisory and not only the upstream number.
Sources
Last reviewed: 19 October 2026.
