Security Advisory: CVE-2026-109618¶

Summary¶

An out-of-memory (OOM) condition in PHP can leave request memory in an invalid state. During request shutdown, PHP may use that state in a way that can lead to remote code execution (RCE).

Severity¶

Critical — CVSS 4.0: 9.2
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected CEP Releases¶

The main CEP runtime before 1.17.6 contains the affected PHP code. CEP uses PHP-FPM. The upstream advisory confirms RCE in an Apache module configuration and identifies PHP-FPM as susceptible, but does not demonstrate a complete FPM exploit.

CEP limits request bodies at Nginx, which reduces some known multipart OOM triggers. This is not a complete mitigation for all OOM conditions.

Fixed Version¶

CEP 1.17.6 includes the upstream PHP fix in its main runtime.

Recommendation¶

Upgrade to CEP 1.17.6 or later. Treat earlier main-runtime releases as potentially affected. Request limits and memory controls reduce some attack paths but do not replace the security update.