EUVD-2026-125087

FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv is called during request shutdown. Attackers triggering putenv in shutdown functions, destructors, or session handlers can crash the process on the next getenv...

CVE-2026-128015

FrankenPHP versions prior to 1.13.4 are vulnerable to a use-after-free issue (CWE-416) occurring when putenv() is called during request shutdown. This operation leaves a dangling pointer to a freed environment table. An attacker triggering putenv() via shutdown functions, destructors, or session ...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP-FPM CVE-2026-109618 research lab This repository is a sel...

Reference counting in php_request_shutdown causes Use-After-Free

...

BIT-LIBPHP-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free

In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the...

PHP php_request_shutdown Code Execution

The vulnerability of the phprequestshutdown function in the PHP programming language lies in the possibility of accessing memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

php: Reference counting in php_request_shutdown causes Use-After-Free

A flaw was found in PHP. This vulnerability allows remote code execution via a crafted code path involving the set magic method or the null coalescing assignment ??= operator, in combination with exception handling. Attackers can trigger a use-after-free condition by controlling the memory layout...

php: Reference counting in php_request_shutdown causes Use-After-Free

A flaw was found in PHP. This vulnerability allows remote code execution via a crafted code path involving the set magic method or the null coalescing assignment ??= operator, in combination with exception handling. Attackers can trigger a use-after-free condition by controlling the memory layout...

SUSE CVE-2010-2093

Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service crash via a stream context structure that is freed before destruction occurs...

php:php-fuzz-execute: Heap-buffer-overflow in shutdown_executor

Detailed Report: https://oss-fuzz.com/testcase?key=5890720298827776 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x606000015258 Crash State: shutdownexecutor zenddeactivate...

Circumvents open_basedir INI directive

ADVISORY: This release circumvents openbasedir in the requestinithook. If you rely on the openbasedir INI directive, we highly recommended you upgrade to 0.30.2. Fixed - Shutdown span flushing blocking the process when forked 493 - Memory access errors in cases when PHP code was run after extensi...

CVE-2010-2093: Undefined Security Weakness

Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service crash via a stream context structure that is freed before destruction occurs...

MOPB-22-2007:PHP session_regenerate_id() Double Free Vulnerability

Summary The sessionregenerateid function that is used to generate a new session identifier fails to clear an already freed pointer to the former session identifier before calling the session identifier generator. When this generator triggers an error this can result in a double free that is easil...