[CLSA-2026:1792667528] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 11:12:19 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - debian/patches/php-8.2-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int, and restrict the session upload-progress handler so it no longer runs user code while it decodes and re-encodes the session mid-request (in_rfc1867_update, incomplete-classes-only serialization, a modules_activated guard and a _SESSION cleanup); upstream 01a40e89 (PHP 8.2 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php82_8.2.34-6_amd64.deb
    sha:a966fc06bee45fe87ff7807d30ca63f53dbc7495
  • alt-php82-bcmath_8.2.34-6_amd64.deb
    sha:f298712b987373e7d3a4b1587248b3f99aa0dbd8
  • alt-php82-cli_8.2.34-6_amd64.deb
    sha:222611194f3e196fb83faee0de51735ffdbbcbec
  • alt-php82-common_8.2.34-6_amd64.deb
    sha:cedff2cb00a5535951d86b060dbfbe1d365557b5
  • alt-php82-dba_8.2.34-6_amd64.deb
    sha:cb165b8fc1ba46ebb0664e0857effd771be6be11
  • alt-php82-dev_8.2.34-6_amd64.deb
    sha:0e925909121e82973a77f821c470b813198903d6
  • alt-php82-enchant_8.2.34-6_amd64.deb
    sha:08ab6fb7891fdd988f0b522260b7ec79b6e49fdd
  • alt-php82-firebird_8.2.34-6_amd64.deb
    sha:b4604ab63b6dcd2ba7ae856cdf01585e6d950023
  • alt-php82-gd_8.2.34-6_amd64.deb
    sha:7b30d2565686c58de4f8ba3b443124e2523f1967
  • alt-php82-imap_8.2.34-6_amd64.deb
    sha:a4155820dbb61c9de75da1e5d61f77d21b2be78f
  • alt-php82-intl_8.2.34-6_amd64.deb
    sha:7324731202d25709d41f77b7c60671c22a276ed7
  • alt-php82-ldap_8.2.34-6_amd64.deb
    sha:b52cc393f5440c9fde7589f0aee17c04647ec0d3
  • alt-php82-mbstring_8.2.34-6_amd64.deb
    sha:44c6159909e9685fbc1d407210b2befc63df6cb3
  • alt-php82-mysqlnd_8.2.34-6_amd64.deb
    sha:712737ce3c52216ef98d8781791085484e45e17a
  • alt-php82-odbc_8.2.34-6_amd64.deb
    sha:64f2f6471b68cabad29f1b38147670a8a0bc6ebb
  • alt-php82-opcache_8.2.34-6_amd64.deb
    sha:83673b6199fcd426a496cfa8c81e6174e7fbadb1
  • alt-php82-pdo_8.2.34-6_amd64.deb
    sha:1c348246370fd36392f6dfce1eac9213d5b7e344
  • alt-php82-pgsql_8.2.34-6_amd64.deb
    sha:967f765ac4ccbb79604a982958ccbea05d07542e
  • alt-php82-php-fpm_8.2.34-6_amd64.deb
    sha:ec4b76fecfc7695a6d374748a7fabc8872435fea
  • alt-php82-process_8.2.34-6_amd64.deb
    sha:e3d9347a2e52a6c48377d09f48590c7352c4ab87
  • alt-php82-pspell_8.2.34-6_amd64.deb
    sha:a075de2036753d6d7bc2db4aec07e86a1022201e
  • alt-php82-snmp_8.2.34-6_amd64.deb
    sha:fb9c9d823df9bb3f6aef0ee5a750e23d99421914
  • alt-php82-soap_8.2.34-6_amd64.deb
    sha:06cfcf29e849be9733396f9fb4c7b84755b00459
  • alt-php82-sodium_8.2.34-6_amd64.deb
    sha:e1c64cbd5897d7f1e1734735a0da77e529ec8f6c
  • alt-php82-tidy_8.2.34-6_amd64.deb
    sha:7e7ef0fdc55180dacef3203e3185d1467324f4c7
  • alt-php82-xml_8.2.34-6_amd64.deb
    sha:acc69b9b8230bfe76cd839ffa0757e59af35b63e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.