View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0002442XdebugStacktracespublic2026-10-22 07:502026-10-22 07:54
Reporterarchon810 Assigned To 
PriorityhighSeveritycrashReproducibilityalways
Status newResolutionopen 
Summary0002442: SIGSEGV crash in xdebug_hash_destroy from xdebug_debugger_post_deactivate in xdebug 3.5.3 and PHP 8.3.36
Description

Hi,

I'm running this project to scan for the php2shell vulnerabilities https://github.com/assetnote/php2shell-scanner and it's currently causing error 500s on patched servers (such as mod_php 8.3.36). However, on a server with xdebug 3.5.3, it causes a segfault.

Here's the stack trace:

coredumpctl info
PID: 641891 (httpd-prefork)
UID: 30 (wwwrun)
GID: 8 (www)
Signal: 11 (SEGV)
Timestamp: Thu 2026-10-22 00:35:58 PDT (13s ago)
Command Line: /usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DSTATUS -DEXTENDED_STATUS -C $'PidFile /run/httpd.pid' -C $'Include /etc/apache2/sysconfig.d//loadmodule.conf' -C >
Executable: /usr/sbin/httpd-prefork
Control Group: /system.slice/apache2.service
Unit: apache2.service
Slice: system.slice
Boot ID: **
Machine ID: **
Hostname: **
Storage: /var/lib/systemd/coredump/core.httpd-prefork.30.7ed6e01e97214b66ad7c4b6cc9bc673b.641891.1792654558000000.zst (present)
Size on Disk: 39.4M
Message: Process 641891 (httpd-prefork) of user 30 dumped core.

            Stack trace of thread 641891:
            #0  0x00007fe1638a6aa4 xdebug_hash_destroy (xdebug.so + 0x1eaa4)
            #1  0x00007fe1638bcdfc xdebug_debugger_post_deactivate (xdebug.so + 0x34dfc)
            #2  0x00007fe16389fb20 zm_post_zend_deactivate_xdebug (xdebug.so + 0x17b20)
            #3  0x00007fe1640ce786 zend_post_deactivate_modules (mod_php8.so + 0x2ce786)
            #4  0x00007fe164053036 php_request_shutdown (mod_php8.so + 0x253036)
            #5  0x00007fe1641bd227 n/a (mod_php8.so + 0x3bd227)
            #6  0x00005641a691a340 ap_run_handler (/usr/sbin/httpd-prefork + 0x60340)
            #7  0x00005641a691dec6 ap_invoke_handler (/usr/sbin/httpd-prefork + 0x63ec6)
            #8  0x00005641a69442e5 ap_process_async_request (/usr/sbin/httpd-prefork + 0x8a2e5)
            #9  0x00005641a694450f ap_process_request (/usr/sbin/httpd-prefork + 0x8a50f)
            #10 0x00005641a694487b ap_process_http_sync_connection (/usr/sbin/httpd-prefork + 0x8a87b)
            #11 0x00005641a6930200 ap_run_process_connection (/usr/sbin/httpd-prefork + 0x76200)
            #12 0x00005641a6947ee9 child_main (/usr/sbin/httpd-prefork + 0x8dee9)
            #13 0x00005641a6948364 make_child (/usr/sbin/httpd-prefork + 0x8e364)
            #14 0x00005641a69483b1 startup_children (/usr/sbin/httpd-prefork + 0x8e3b1)
            #15 0x00005641a6949cf3 prefork_run (/usr/sbin/httpd-prefork + 0x8fcf3)
            #16 0x00005641a68fafc0 ap_run_mpm (/usr/sbin/httpd-prefork + 0x40fc0)
            #17 0x00005641a68fa32c main (/usr/sbin/httpd-prefork + 0x4032c)
            #18 0x00007fe165647340 __libc_start_call_main (libc.so.6 + 0x2a340)
            #19 0x00007fe165647409 __libc_start_main_impl (libc.so.6 + 0x2a409)
            #20 0x00005641a68fa455 _start (/usr/sbin/httpd-prefork + 0x40455)
            ELF object binary architecture: AMD x86-64
Additional Information

php -v
PHP 8.3.36 (cli) (built: Oct 21 2026 14:03:00) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

Error log:
PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 2097152 bytes) in Unknown on line 0

Btw, this issue tracker doesn't list version 3.5.3 (only 3.5.1), and PHP only goes up to 8.3.29.

TagsNo tags attached.
Operating SystemOpenSUSE 16.0
PHP Version8.3-dev

Activities

archon810

2026-10-22 07:52

reporter   ~0007532

I had a lot of trouble creating this issue because the response kept complaining about some 'version' field, even though I was filling it in. Eventually, I switched PHP to 8.3-dev and the xdebug version to blank, and it finally got accepted. "3.5.1" was not working.

archon810

2026-10-22 07:54

reporter   ~0007533

bt full

#0 xdebug_hash_destroy (h=0x0) at /tmp/pear/temp/xdebug/src/lib/hash.c:282
i = 0
#1 0x00007fe1638bcdfc in xdebug_debugger_post_deactivate () at /tmp/pear/temp/xdebug/src/debugger/debugger.c:962
No locals.
0000002 0x00007fe16389fb20 in zm_post_zend_deactivate_xdebug () at /tmp/pear/temp/xdebug/xdebug.c:708
No locals.
0000003 0x00007fe1640ce786 in zend_post_deactivate_modules () from /usr/lib64/apache2/mod_php8.so
No symbol table info available.
0000004 0x00007fe164053036 in php_request_shutdown () from /usr/lib64/apache2/mod_php8.so
No symbol table info available.
0000005 0x00007fe1641bd227 in ?? () from /usr/lib64/apache2/mod_php8.so
No symbol table info available.
0000006 0x00005641a691a340 in ap_run_handler (r=r@entry=0x5641b0d74c40) at server/config.c:169
pHook = <optimized out>
n = 10
rv = -1
0000007 0x00005641a691dec6 in ap_invoke_handler (r=0x5641b0d74c40) at server/config.c:443
handler = <optimized out>
p = <optimized out>
result = <optimized out>
old_handler = 0x5641b0d87098 "application/x-httpd-php"
ignore = <optimized out>
0000008 0x00005641a69442e5 in ap_process_async_request (r=0x5641b0d74c40) at modules/http/http_request.c:452
c = <optimized out>
access_status = 0
0000009 0x00005641a694450f in ap_process_request (r=r@entry=0x5641b0d74c40) at modules/http/http_request.c:487
bb = 0x1e8480
b = <optimized out>
c = 0x5641b0d59f50
rv = <optimized out>
0000010 0x00005641a694487b in ap_process_http_sync_connection (c=0x5641b0d59f50) at modules/http/http_core.c:208
keep_alive_timeout = 2000000
r = 0x5641b0d74c40
cs = <optimized out>
csd = 0x0
mpm_state = 0
r = <optimized out>
cs = <optimized out>
csd = <optimized out>
mpm_state = <optimized out>
keep_alive_timeout = <optimized out>
0000011 ap_process_http_connection (c=0x5641b0d59f50) at modules/http/http_core.c:249
No locals.
0000012 0x00005641a6930200 in ap_run_process_connection (c=0x5641b0d59f50) at server/connection.c:42
pHook = <optimized out>
n = 2
rv = -1
0000013 0x00005641a6947ee9 in child_main (child_num_arg=child_num_arg@entry=18, child_bucket=child_bucket@entry=0) at server/mpm/prefork/prefork.c:667
current_conn = 0x5641b0d59f50
csd = 0x5641b0d59d60
--Type <RET> for more, q to quit, c to continue without paging--
thd = 0x5641b0d57d50
sig_mask = {__val = {0, 140606047525159, 94839967605472, 0, 2, 140606047524128, 94840133468200, 94840133468168, 0, 94840133476584, 641890, 140606047525999, 0,
94839967327536, 94839967605328, 13419726790430428928}}
ptrans = 0x5641b0d59ce8
allocator = 0x5641b0d55b00
status = <optimized out>
i = <optimized out>
lr = <optimized out>
pollset = 0x5641b0d55f18
sbh = 0x5641b0d55f10
bucket_alloc = 0x5641b0d697a8
last_poll_idx = 1
lockfile = <optimized out>
0000014 0x00005641a6948364 in make_child (s=0x5641b07760e8, slot=slot@entry=18) at server/mpm/prefork/prefork.c:773
bucket = 0
pid = <optimized out>
0000015 0x00005641a69483b1 in startup_children (number_to_start=7) at server/mpm/prefork/prefork.c:791
i = 18
0000016 0x00005641a6949cf3 in prefork_run (_pconf=<optimized out>, plog=0x5641b077b748, s=0x5641b07760e8) at server/mpm/prefork/prefork.c:953
index = <optimized out>
remaining_children_to_start = <optimized out>
i = <optimized out>
0000017 0x00005641a68fafc0 in ap_run_mpm (pconf=pconf@entry=0x5641b074c3c8, plog=0x5641b077b748, s=0x5641b07760e8) at server/mpm_common.c:95
pHook = <optimized out>
n = 0
rv = -1
0000018 0x00005641a68fa32c in main (argc=<optimized out>, argv=<optimized out>) at server/main.c:843
c = 68 'D'
showcompile = <optimized out>
showdirectives = <optimized out>
confname = <optimized out>
def_server_root = <optimized out>
temp_error_log = <optimized out>
error = <optimized out>
process = 0x5641b074a4a8
pconf = 0x5641b074c3c8
plog = 0x5641b077b748
ptemp = 0x5641b07796d8
pcommands = 0x5641b07705b8
opt = 0x5641b07706a8
rv = <optimized out>
mod = <optimized out>
opt_arg = 0x7fff4dd782f1 "FOREGROUND"
signal_server = <optimized out>
rc = <optimized out>