A heap use-after-free vulnerability has been identified in PHP’s session.upload_progress handler affecting versions 8.2.34, 8.3.35, 8.4.26, and 8.5.11, according to security researcher analysis published at jackalsyn.com.
The vulnerability exists in PHP’s session.c file, where the php_session_rfc1867_callback function caches two raw zval bucket pointers—post_bytes_processed and current_file_bytes_processed—into live HashTables. These pointers reference arrays that are freed during the request lifecycle, leaving stale references that can be exploited.
According to the analysis, the attack requires minimal configuration: the default session.upload_progress settings (enabled=1, with default name, prefix, and freq=1%, min_freq=1). An attacker can arm the vulnerable cache with a single fast multipart POST request, then trigger a second update that causes the session file to be re-read. This operation invokes zend_hash_update, which destroys the previously decoded tree through its HashTable destructor, freeing the bucket. The freed memory can then be reclaimed with attacker-controlled data shaped as a zend_fcall_info or zend_internal_function structure, potentially leading to execution of arbitrary functions including system().
The researcher has validated the vulnerability against real php-src builds, verifying line references, memory offsets (including zval_ptr_dtor and zend_call_function distances that vary per build), and struct layouts across multiple distributions including Debian bookworm, Ubuntu noble, and Ubuntu jammy.
Temporary mitigations are available before official patches release. Users can disable session.upload_progress in php.ini or .user.ini files and reload their PHP-FPM or web server. Additionally, organizations can implement rate-limiting or inspection of multipart/form-data POST requests at the network edge using WAFs or reverse proxies, particularly for endpoints that don’t require file uploads.
The researcher recommends inventorying all PHP installations and versions immediately, as PHP 7.x and older versions will not receive security patches. Users should apply temporary mitigations tonight and plan to patch as soon as official updates become available, particularly if running managed hosting where provider timelines should be confirmed.
Key facts
- A heap use-after-free exists in PHP’s session.upload_progress handler affecting versions 8.2.34, 8.3.35, 8.4.26, and 8.5.11
- The vulnerability can be triggered with default PHP configuration using multipart POST requests
- Exploitation could lead to arbitrary function execution including system() calls
- Temporary mitigation involves disabling session.upload_progress in php.ini or rate-limiting multipart requests at the network edge
- PHP 7.x and older versions will not receive security patches