Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-30T11:22:53 php: PHP: Denial of Service via circular symbolic links in phar archives 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-606

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

A flaw was found in PHP. When processing a specially crafted PHP Archive (phar) file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow an attacker to trigger a Denial of Service (DoS) condition, making the affected PHP service unavailable.

This Moderate impact flaw in PHP allows a local attacker to trigger a denial of service by providing a specially crafted phar archive containing circular symbolic links. Successful exploitation exhausts the C stack, leading to a PHP process crash, which can disrupt services utilizing PHP for archive processing. To mitigate this issue, avoid processing phar archives from untrusted sources. If the `phar` extension is not essential for your application, consider disabling it in the PHP configuration. Disabling the `phar` extension may impact applications that rely on it for legitimate archive handling. Red Hat Hardened Images 2026-07-28T00:00:00Z RHSA-2026:47200 php-main-8.5.9-1.hum1 Red Hat Enterprise Linux 10 Fix deferred php Red Hat Enterprise Linux 10 Fix deferred php8.4 Red Hat Enterprise Linux 6 Fix deferred php Red Hat Enterprise Linux 7 Fix deferred php Red Hat Enterprise Linux 8 Fix deferred php:7.4/php Red Hat Enterprise Linux 8 Fix deferred php:8.2/php Red Hat Enterprise Linux 9 Fix deferred php Red Hat Enterprise Linux 9 Fix deferred php:8.2/php Red Hat Enterprise Linux 9 Fix deferred php:8.3/php Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/code-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-7260 https://nvd.nist.gov/vuln/detail/CVE-2026-7260 https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3