In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

According to its self-reported version number, the version of PHP installed on the remote host is 8.5.x prior to 8.5.7. It is, therefore, affected by multiple vulnerabilities:

 - Pointer difference truncation to int in various places (uriparser before 1.0.2). (CVE-2026-44927)

 - The EqualsUri function family can misclassify two unequal URIs as equal (uriparser before 1.0.2). (CVE-2026-44928)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.7. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.7 advisory.

  - In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

  - In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
    (CVE-2026-44927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1733 advisory.

    uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

    In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
    (CVE-2026-44927)

    In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
115262	PHP 8.5.x < 8.5.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
318691	PHP 8.5.x < 8.5.7 Multiple Vulnerabilities	Nessus	CGI abuses	medium
316984	Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1733)	Nessus	Amazon Linux Local Security Checks	critical
313436	Linux Distros Unpatched Vulnerability : CVE-2026-44928	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-44928

medium

Tenable Plugins

medium

medium

critical

medium