CVE-2026-7261 is a use-after-free in PHP's SOAP extension, scored 9.8 (critical) by NVD. It applies when SoapServer uses SOAP_PERSISTENCE_SESSION. It is fixed in PHP 8.2.31, 8.3.31, 8.4.21 and 8.5.6. Upgrade to a fixed release, or stop using that persistence mode until you can.
What's affected
PHP versions below 8.2.31 in the 8.2 line, below 8.3.31, below 8.4.21 and below 8.5.6, according to the GitHub advisory. The fixed releases are 8.2.31, 8.3.31, 8.4.21 and 8.5.6.
Only applications that run a SoapServer with session persistence are in scope. That means code that calls setPersistence with SOAP_PERSISTENCE_SESSION. A server that does not use that setting does not reach the bug.
The advisory scores the issue lower than NVD does, calling it moderate at 6.3 under CVSS 4.0, and notes that a SOAP server normally handles one request per PHP request, which makes it hard for an attacker to control the freed memory. The NVD score is 9.8. Use the vendor view for planning and the NVD score for triage rules.
How to check if you're exposed
Check the PHP version on each host.
php -v
Check whether the SOAP extension is loaded.
php -m | grep -i soap
Search your code for the risky setting.
grep -rn "SOAP_PERSISTENCE_SESSION" /path/to/app
If the grep finds nothing and you never set persistence through a library, the vulnerable path is not in use. Remember that web server PHP and command line PHP can be different builds, so check the one that serves requests.
What to do now
- Upgrade PHP to 8.2.31, 8.3.31, 8.4.21, 8.5.6 or later, using your distribution's packages where you can.
- Search for SOAP_PERSISTENCE_SESSION in your applications and libraries.
- Where it is used and you cannot upgrade yet, switch to a mode that does not persist the handler object in the session.
- Restart PHP-FPM or the web server after the upgrade so that the new build is loaded.
- Check distribution advisories, since vendors often backport fixes without changing the version number.
Why it matters
The record maps this to CWE-416, use after free. The advisory explains the cause in plain terms. Normally the SOAP handler object is released after a request. With session persistence it is supposed to live on and be saved to the session. When a header handler fails or throws, the code released the object anyway and then still wrote it into the session, so the saved data pointed at freed memory.
Use after free bugs can cause crashes, information disclosure or memory corruption, depending on whether an attacker can control what takes the freed slot. The advisory says that is unlikely here but not impossible.
The record's KEV flag is false and it does not describe exploitation.
Checking more than one PHP
Servers often have more than one PHP. The command line version can differ from the one that serves web requests, and a host may run several versions side by side for different sites. List the PHP-FPM pools or Apache module versions as well as the command line one. Containers add another layer, since an image can hold an older PHP than the host. Check each image you deploy.
Distribution packages deserve a second look too. Linux distributions often backport security fixes while keeping the original version string, so php -v may show an older number on a patched build. The distribution's security tracker for this CVE will tell you whether your package carries the fix.
Why legacy SOAP code lingers
SOAP services are common in older business integrations, and they tend to stay in place for years. Session persistence was a convenience for stateful handlers. If you find it in a code base, ask whether the state really needs to live in the handler object. Storing the state explicitly in the session, and creating a fresh handler for each request, removes this whole class of problem.
The free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project you maintain pulls in an affected package, and the Gold vulnerability directory keeps the record for this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I never use SOAP sessions?
The bug needs SOAP_PERSISTENCE_SESSION. Without it you are not exposed, but PHP upgrades are worth doing anyway.
Why does the advisory score differ from NVD?
They use different CVSS versions and judgments about attack requirements. Both agree the fix is the same set of releases.
Sources
Last reviewed: 19 October 2026.
