PHP Memory & Upload Progress Sandbox
Personal testing environment and audit harness for critical pre-authentication vulnerabilities in the PHP Zend Engine (CVE-2026-109618 & CVE-2026-109619). Co-created by Suraj Tiwari (@surajtiwari020) and CP Dhaundiyal (@dhaundiyalcp).
Patched: 8.2.35+, 8.3.36+, 8.4.27+
Directive: upload_progress
Ceiling before zend_bailout
Total received requests
CVE-2026-109618: Out-of-Memory Longjmp Flaw
Zend Engine Memory Exhaustion Abort Flow
When an incoming HTTP request forces an allocation failure during request startup (e.g. while parsing
nested multipart boundaries in rfc1867.c), PHP invokes zend_bailout(). This bails out
via longjmp(), jumping over internal cleanup handlers and leaving pointers in an invalid, half-allocated state.
| Impact | Remote Code Execution / Heap Corruption |
|---|---|
| Affected | PHP 5.4.0 through 8.5.11 |
| CWE | CWE-703 (Improper Check for Exceptional Conditions) |
CVE-2026-109619: Stale Worker State / UAF
Persistent FPM Worker State Contamination
Because PHP-FPM and web-server modules reuse worker processes across subsequent requests, aborted request structures registered in the session HashTable can remain resident in memory. Subsequent incoming requests processed by the same worker thread can dereference these dangling pointers (Use-After-Free).
| Impact | Sensitive Memory Disclosure / Authentication Bypass |
|---|---|
| Mitigation | Disable session.upload_progress.enabled in php.ini |
| CWE | CWE-416 (Use-After-Free) |
Interactive Multipart Diagnostics Sandbox
Send an RFC 1867 multipart form request to inspect how the runtime manages upload progress tracking keys