From 79551ab8b1a97760c739e372f9bc359619f3554d Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Sat, 25 Apr 2026 00:44:37 +0200 Subject: [PATCH] GHSA-hmxp-6pc4-f3vv: [soap] Fix broken Apache map value NULL check Fixes GHSA-hmxp-6pc4-f3vv Fixes CVE-2026-7262 --- ext/soap/php_encoding.c | 2 +- ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt | 39 +++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt Index: php-7.4.33/ext/soap/php_encoding.c =================================================================== --- php-7.4.33.orig/ext/soap/php_encoding.c +++ php-7.4.33/ext/soap/php_encoding.c @@ -2706,7 +2706,7 @@ static zval *to_zval_map(zval *ret, enco } xmlValue = get_node(item->children, "value"); - if (!xmlKey) { + if (!xmlValue) { soap_error0(E_ERROR, "Encoding: Can't decode apache map, missing value"); }