out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
Read the notes from the security team
Why is this CVE critical priority?
This is a remote code execution vulnerability
How can I get the fixes?
What do statuses mean?
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
This is GHSA-w8hw-w9fx-j79w
Related Ubuntu Security Notices (USN)
Access our resources on patching vulnerabilities
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
