Skip to content
OpenAdvisories
High ALAS2-2026-4015 1 CVE

Important: php security update (Amazon Linux 2)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-91765: cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Fixed packages 25

ReleasePackageFixed in
Amazon Linux · 2 php 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-bcmath 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-cli 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-common 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-dba 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-debuginfo 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-devel 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-embedded 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-enchant 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-fpm 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-gd 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-intl 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-ldap 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-mbstring 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-mysqlnd 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-odbc 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-pdo 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-pgsql 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-process 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-pspell 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-recode 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-snmp 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-soap 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-xml 0:5.4.16-46.amzn2.0.8
Amazon Linux · 2 php-xmlrpc 0:5.4.16-46.amzn2.0.8

Vulnerabilities 1

  • High 7.5
    CVE-2026-91765

    SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

    cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-91765.html