Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4015
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
Severity:
Important
Issue Overview:
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper. (CVE-2026-91765)
Affected Packages:
php
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update php or yum update --advisory ALAS2-2026-4015 to update your system.
New Packages:
aarch64:
php-5.4.16-46.amzn2.0.8.aarch64
php-cli-5.4.16-46.amzn2.0.8.aarch64
php-fpm-5.4.16-46.amzn2.0.8.aarch64
php-common-5.4.16-46.amzn2.0.8.aarch64
php-devel-5.4.16-46.amzn2.0.8.aarch64
php-ldap-5.4.16-46.amzn2.0.8.aarch64
php-pdo-5.4.16-46.amzn2.0.8.aarch64
php-mysqlnd-5.4.16-46.amzn2.0.8.aarch64
php-pgsql-5.4.16-46.amzn2.0.8.aarch64
php-process-5.4.16-46.amzn2.0.8.aarch64
php-odbc-5.4.16-46.amzn2.0.8.aarch64
php-soap-5.4.16-46.amzn2.0.8.aarch64
php-snmp-5.4.16-46.amzn2.0.8.aarch64
php-xml-5.4.16-46.amzn2.0.8.aarch64
php-xmlrpc-5.4.16-46.amzn2.0.8.aarch64
php-mbstring-5.4.16-46.amzn2.0.8.aarch64
php-gd-5.4.16-46.amzn2.0.8.aarch64
php-bcmath-5.4.16-46.amzn2.0.8.aarch64
php-dba-5.4.16-46.amzn2.0.8.aarch64
php-embedded-5.4.16-46.amzn2.0.8.aarch64
php-pspell-5.4.16-46.amzn2.0.8.aarch64
php-recode-5.4.16-46.amzn2.0.8.aarch64
php-intl-5.4.16-46.amzn2.0.8.aarch64
php-enchant-5.4.16-46.amzn2.0.8.aarch64
php-debuginfo-5.4.16-46.amzn2.0.8.aarch64
i686:
php-5.4.16-46.amzn2.0.8.i686
php-cli-5.4.16-46.amzn2.0.8.i686
php-fpm-5.4.16-46.amzn2.0.8.i686
php-common-5.4.16-46.amzn2.0.8.i686
php-devel-5.4.16-46.amzn2.0.8.i686
php-ldap-5.4.16-46.amzn2.0.8.i686
php-pdo-5.4.16-46.amzn2.0.8.i686
php-mysqlnd-5.4.16-46.amzn2.0.8.i686
php-pgsql-5.4.16-46.amzn2.0.8.i686
php-process-5.4.16-46.amzn2.0.8.i686
php-odbc-5.4.16-46.amzn2.0.8.i686
php-soap-5.4.16-46.amzn2.0.8.i686
php-snmp-5.4.16-46.amzn2.0.8.i686
php-xml-5.4.16-46.amzn2.0.8.i686
php-xmlrpc-5.4.16-46.amzn2.0.8.i686
php-mbstring-5.4.16-46.amzn2.0.8.i686
php-gd-5.4.16-46.amzn2.0.8.i686
php-bcmath-5.4.16-46.amzn2.0.8.i686
php-dba-5.4.16-46.amzn2.0.8.i686
php-embedded-5.4.16-46.amzn2.0.8.i686
php-pspell-5.4.16-46.amzn2.0.8.i686
php-recode-5.4.16-46.amzn2.0.8.i686
php-intl-5.4.16-46.amzn2.0.8.i686
php-enchant-5.4.16-46.amzn2.0.8.i686
php-debuginfo-5.4.16-46.amzn2.0.8.i686
src:
php-5.4.16-46.amzn2.0.8.src
x86_64:
php-5.4.16-46.amzn2.0.8.x86_64
php-cli-5.4.16-46.amzn2.0.8.x86_64
php-fpm-5.4.16-46.amzn2.0.8.x86_64
php-common-5.4.16-46.amzn2.0.8.x86_64
php-devel-5.4.16-46.amzn2.0.8.x86_64
php-ldap-5.4.16-46.amzn2.0.8.x86_64
php-pdo-5.4.16-46.amzn2.0.8.x86_64
php-mysqlnd-5.4.16-46.amzn2.0.8.x86_64
php-pgsql-5.4.16-46.amzn2.0.8.x86_64
php-process-5.4.16-46.amzn2.0.8.x86_64
php-odbc-5.4.16-46.amzn2.0.8.x86_64
php-soap-5.4.16-46.amzn2.0.8.x86_64
php-snmp-5.4.16-46.amzn2.0.8.x86_64
php-xml-5.4.16-46.amzn2.0.8.x86_64
php-xmlrpc-5.4.16-46.amzn2.0.8.x86_64
php-mbstring-5.4.16-46.amzn2.0.8.x86_64
php-gd-5.4.16-46.amzn2.0.8.x86_64
php-bcmath-5.4.16-46.amzn2.0.8.x86_64
php-dba-5.4.16-46.amzn2.0.8.x86_64
php-embedded-5.4.16-46.amzn2.0.8.x86_64
php-pspell-5.4.16-46.amzn2.0.8.x86_64
php-recode-5.4.16-46.amzn2.0.8.x86_64
php-intl-5.4.16-46.amzn2.0.8.x86_64
php-enchant-5.4.16-46.amzn2.0.8.x86_64
php-debuginfo-5.4.16-46.amzn2.0.8.x86_64