Homepage

Use After Free The advisory has been revoked - it doesn't affect any version of package php8.4-mysqlnd  (opens in a new tab)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PHP84MYSQLND-21388765
  • published21 Oct 2026
  • disclosed21 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 21 Oct 2026

NewCVE-2026-109619  (opens in a new tab)
CWE-416  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php8.4-mysqlnd package and not the php8.4-mysqlnd package as distributed by RHEL.

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).