The advisory's second multipart out-of-memory route is: "A multipart part can contain an unrestricted number of headers. Representing these headers inside PHP can use substantially more memory than their wire representation, allowing a request within `post_max_size` to exhaust the normal `memory_limit`."

The exact words it rests on

A multipart part can contain an unrestricted number of headers. Representing these headers inside PHP can use substantially more memory than their wire representation, allowing a request within `post_max_size` to exhaust the normal `memory_limit`.

What the source said when we opened it, on 23 Oct 2026.

The source

GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
PHP project (php-src security advisories) · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 23 Oct 2026, against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026