Medium severity6.5NVD Advisory· Published May 10, 2026· Updated May 12, 2026
CVE-2026-7259
CVE-2026-7259
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
33- osv-coords31 versionspkg:apk/chainguard/php-8.2pkg:apk/wolfi/php-8.2pkg:bitnami/libphppkg:bitnami/phppkg:bitnami/php-minpkg:rpm/almalinux/phppkg:rpm/almalinux/php-bcmathpkg:rpm/almalinux/php-clipkg:rpm/almalinux/php-commonpkg:rpm/almalinux/php-dbapkg:rpm/almalinux/php-dbgpkg:rpm/almalinux/php-develpkg:rpm/almalinux/php-embeddedpkg:rpm/almalinux/php-enchantpkg:rpm/almalinux/php-ffipkg:rpm/almalinux/php-fpmpkg:rpm/almalinux/php-gdpkg:rpm/almalinux/php-gmppkg:rpm/almalinux/php-intlpkg:rpm/almalinux/php-ldappkg:rpm/almalinux/php-mbstringpkg:rpm/almalinux/php-mysqlndpkg:rpm/almalinux/php-odbcpkg:rpm/almalinux/php-opcachepkg:rpm/almalinux/php-pdopkg:rpm/almalinux/php-pgsqlpkg:rpm/almalinux/php-processpkg:rpm/almalinux/php-snmppkg:rpm/almalinux/php-soappkg:rpm/almalinux/php-xmlpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed
< 8.2.31-r0+ 30 more
- (no CPE)range: < 8.2.31-r0
- (no CPE)range: < 8.2.31-r0
- (no CPE)range: >= 8.2.0, < 8.2.31
- (no CPE)range: >= 8.2.0, < 8.2.31
- (no CPE)range: >= 8.2.0, < 8.2.31
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.3.31-1.el10_2
- (no CPE)range: < 8.5.6-1.1
Patches
Vulnerability mechanics
References
1- github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75nvdVendor Advisory
News mentions
1- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026