[CLSA-2026:1779439736] Fix CVE(s): CVE-2026-6722, CVE-2026-7261, CVE-2026-7262
Type:
security
Severity:
Critical
Release date:
2026-05-22 08:49:00 UTC
Description:
* SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys - debian/patches/php-5.2-CVE-2026-6722.patch: backport upstream commit aee3b3ac9b in ext/soap/php_encoding.c — adapt addref/dtor changes to pre-PHP7 zval** SOAP API. - Note: the 5.2 backport applies the addref half of the upstream fix only; the matching ref_map destructor change (NULL -> ZVAL_PTR_DTOR) is intentionally omitted because in 5.x ref_map is heterogeneous (stores both xmlNodePtr and zval* entries through the same API) and a ZVAL_PTR_DTOR would corrupt the xmlNodePtr entries. The addref alone closes the UAF; cost is one bounded zval leak per request, released with the emalloc pool at RSHUTDOWN. - CVE-2026-6722 * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map item missing element - debian/patches/php-5.2-CVE-2026-7262.patch: backport upstream commit 79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in to_zval_map() (was checking xmlKey, should check xmlValue). - CVE-2026-7262 * SECURITY UPDATE: soap extension use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION - debian/patches/php-5.2-CVE-2026-7261.patch: backport upstream commit db2a7f9348 in ext/soap/soap.c — wrap both zval_ptr_dtor(&soap_obj) sites in the header-handler failure paths with a persistance!=SOAP_PERSISTENCE_SESSION guard. - CVE-2026-7261
Updated packages:
  • alt-php52_5.2.17-221_amd64.deb
    sha:fab36a760a79c15fe58c43c3eb2d97d0a871952b
  • alt-php52-bcmath_5.2.17-221_amd64.deb
    sha:9663775ecf23955e2e24460d512fc0d2b8e9df40
  • alt-php52-cli_5.2.17-221_amd64.deb
    sha:fe9adbf57c06c0f3c5dab9ee2a08fea6f651e2ff
  • alt-php52-common_5.2.17-221_amd64.deb
    sha:55b2890fbfc5edbe87d148c95373a74df52faadc
  • alt-php52-dba_5.2.17-221_amd64.deb
    sha:59c940c9de5ddce5bf30a201d9e2c9513e7edd5c
  • alt-php52-dbx_5.2.17-221_amd64.deb
    sha:0d304a07940dedf2dc4b50c79832bbc7ec47eb66
  • alt-php52-dev_5.2.17-221_amd64.deb
    sha:c835fc9dfa6b364131fb8b408939a6e88373ab88
  • alt-php52-enchant_5.2.17-221_amd64.deb
    sha:3da017ea4725512acc7d01ea8c8c0476fd57dfd7
  • alt-php52-firebird_5.2.17-221_amd64.deb
    sha:871960b6c9bb7fcef30b9c49b237494e51799a76
  • alt-php52-gd_5.2.17-221_amd64.deb
    sha:ca5f611be12696c2c741764bb29fc2daf02f4fa4
  • alt-php52-imap_5.2.17-221_amd64.deb
    sha:3f6dc883abea44cc3aac3dd1e7ca1fd50e945116
  • alt-php52-intl_5.2.17-221_amd64.deb
    sha:7efa8a2e6abe73318ece7d14efca11c1e4df8d1e
  • alt-php52-ldap_5.2.17-221_amd64.deb
    sha:a3345c123ff9a54a1505f5e50cc1d2d04d135cf7
  • alt-php52-mbstring_5.2.17-221_amd64.deb
    sha:8cd561df12bcc1fcf4d92faf51a7fc97e8d75b60
  • alt-php52-mcrypt_5.2.17-221_amd64.deb
    sha:46b79a5d12ad453931d03d06b4e655dd182800b0
  • alt-php52-mysqlnd_5.2.17-221_amd64.deb
    sha:4d9cb233e583a48d3f080e93dcfd7d9ae111f282
  • alt-php52-odbc_5.2.17-221_amd64.deb
    sha:3c47a732235771953d8153582c1771402ea03d93
  • alt-php52-pdo_5.2.17-221_amd64.deb
    sha:f890b89f2d3b17aed4fa31bd4b6e5a6f81e35186
  • alt-php52-pgsql_5.2.17-221_amd64.deb
    sha:3f5d772532225e71cd4557a3f95bce73574aab0d
  • alt-php52-process_5.2.17-221_amd64.deb
    sha:7fefd52d901791a79b84c78d4abacb106d512f0e
  • alt-php52-pspell_5.2.17-221_amd64.deb
    sha:005ae43660eabf1efbed2b1f803000c81d4f20e9
  • alt-php52-recode_5.2.17-221_amd64.deb
    sha:f37aba7f8785360f19ab83a89f1f4594f7a1b5a0
  • alt-php52-snmp_5.2.17-221_amd64.deb
    sha:4e0612d94b88a0ad9b06be5b91064f6f21df2292
  • alt-php52-soap_5.2.17-221_amd64.deb
    sha:a0962ee0ff742a0997393772ac91576c3ad2ba4c
  • alt-php52-sqlite_5.2.17-221_amd64.deb
    sha:0a188789e0d6d1c44fde1ba08f45be3c35d7c284
  • alt-php52-sybase_5.2.17-221_amd64.deb
    sha:0d6c798d68bdb90831965a449c548abbace17adf
  • alt-php52-tidy_5.2.17-221_amd64.deb
    sha:5b76a2951c89997146bcfa2a89740eb7972dc305
  • alt-php52-xml_5.2.17-221_amd64.deb
    sha:f7575728f8dce7578ff4acc07e56822819d4d2be
  • alt-php52-xmlrpc_5.2.17-221_amd64.deb
    sha:ce58e39e2e7251d6f5ce484cf76ad89cc0b0e0dd
  • alt-php52_5.2.17-221_arm64.deb
    sha:d2112c0936a690148f64d612ee68ae427f8fb3e7
  • alt-php52-bcmath_5.2.17-221_arm64.deb
    sha:c3e5e6802fa709d147616a958b07f3e48d8c8c4b
  • alt-php52-cli_5.2.17-221_arm64.deb
    sha:5986fec57e8d9ec66430ad6593296590488dc668
  • alt-php52-common_5.2.17-221_arm64.deb
    sha:3857a732b541f1af91dc4a2a6d3d0a10ac79ab90
  • alt-php52-dba_5.2.17-221_arm64.deb
    sha:f76e602f2b6a03f3bb6086cd5dc41d0af875b06b
  • alt-php52-dbx_5.2.17-221_arm64.deb
    sha:f61c70ef34bcb3d6a2466eb4bebdcedabf24058b
  • alt-php52-dev_5.2.17-221_arm64.deb
    sha:609a5280d809f39122fb7a0ffd5ab48fd1930a31
  • alt-php52-enchant_5.2.17-221_arm64.deb
    sha:ee0f36ecbf722ad0224b626fb48e47c2fd77c1b9
  • alt-php52-firebird_5.2.17-221_arm64.deb
    sha:f68c5dbd59d16b63e6d1212433da7c05432fa0a8
  • alt-php52-gd_5.2.17-221_arm64.deb
    sha:c5216fd0d26c650470cf103cd3e7c81c5acf6f29
  • alt-php52-imap_5.2.17-221_arm64.deb
    sha:c73ef3c0155e61a86d5e00f18e12605e3f4a31a2
  • alt-php52-intl_5.2.17-221_arm64.deb
    sha:6f0167e5e19a547058303df20db32947e5c8956b
  • alt-php52-ldap_5.2.17-221_arm64.deb
    sha:fb6f6a80867c4ddcad781a541422ab6bad1f0705
  • alt-php52-mbstring_5.2.17-221_arm64.deb
    sha:03782cdb756935096c37d1f9881add877995e1bd
  • alt-php52-mcrypt_5.2.17-221_arm64.deb
    sha:dbbe4012f39d7deaca4e838681d7c0c30bfa8030
  • alt-php52-mysqlnd_5.2.17-221_arm64.deb
    sha:37afa272e609b5f131771673af0958f42aa8e2d1
  • alt-php52-odbc_5.2.17-221_arm64.deb
    sha:cf709d089438e9093ffd9d7e30ac9a1b89bf6418
  • alt-php52-pdo_5.2.17-221_arm64.deb
    sha:b1c9df0a605e0bf57adaf8e3f405692c2776888f
  • alt-php52-pgsql_5.2.17-221_arm64.deb
    sha:7a46deab62c4be6b0bf13bbf6190eef9c334c1d5
  • alt-php52-process_5.2.17-221_arm64.deb
    sha:3ce8c36d7bf57db8cdd4aaf9341c0999878bcaf5
  • alt-php52-pspell_5.2.17-221_arm64.deb
    sha:0b95003d35c6cf05acc803159bd219f19fbfc946
  • alt-php52-recode_5.2.17-221_arm64.deb
    sha:f3cb456c61a871dea488b2c740345ed02405a2c4
  • alt-php52-snmp_5.2.17-221_arm64.deb
    sha:99287bb7accf91a8d32115179f61035d51d979c7
  • alt-php52-soap_5.2.17-221_arm64.deb
    sha:25d9e977fc277ad64d9ee505da212f6640520577
  • alt-php52-sqlite_5.2.17-221_arm64.deb
    sha:d9bd221afa26c7d83fcb47881536e9e1894bc6a8
  • alt-php52-sybase_5.2.17-221_arm64.deb
    sha:e79d073070124694f5a4f109210a64a01f0a1638
  • alt-php52-tidy_5.2.17-221_arm64.deb
    sha:6893c20457d5051081901769bd7197aa5c1647d6
  • alt-php52-xml_5.2.17-221_arm64.deb
    sha:56fb2c13874c1994a55a9d51bbdfb131abf77e3a
  • alt-php52-xmlrpc_5.2.17-221_arm64.deb
    sha:002aee2eac341c071edf329498665300380e709d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.