[CLSA-2026:1792596520] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 16:44:01 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-7.4-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; upstream 712e60f9 (PHP 7.4 branch) also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php74_7.4.33-81_amd64.deb
    sha:f1535a730389fb649c3a2e0deaa538c4966a43d3
  • alt-php74-bcmath_7.4.33-81_amd64.deb
    sha:4ae5503443c95f28572db66d7252aad54f95bd6f
  • alt-php74-cli_7.4.33-81_amd64.deb
    sha:642a2d509a8458fd317962b54faa0af9cde295b3
  • alt-php74-common_7.4.33-81_amd64.deb
    sha:5a3358013a0288329c76f52396196bf6767facb2
  • alt-php74-dba_7.4.33-81_amd64.deb
    sha:382dfcb20fe629f03f8a671c7f6aed555556bcc3
  • alt-php74-dev_7.4.33-81_amd64.deb
    sha:078119726f5a1ce72f84971dd40bd793a1c5119e
  • alt-php74-enchant_7.4.33-81_amd64.deb
    sha:45b0fa4092cfac3850ccc8875e94287fe3a0e672
  • alt-php74-firebird_7.4.33-81_amd64.deb
    sha:1a3bbf04a97c3ff3989ce9b1e4bea9d8b9ae4c6b
  • alt-php74-gd_7.4.33-81_amd64.deb
    sha:f0da88a6f75f56530116b23b00fdd7f23619b7b2
  • alt-php74-imap_7.4.33-81_amd64.deb
    sha:e8b3bc0e5fedff64ad2af4eaa0f5b4d5df85bef2
  • alt-php74-intl_7.4.33-81_amd64.deb
    sha:6247a9d4f6cce067af4161bf9b0a8dc477766a81
  • alt-php74-ldap_7.4.33-81_amd64.deb
    sha:812e0842cafa8212d6072049978b58d1938d8e48
  • alt-php74-mbstring_7.4.33-81_amd64.deb
    sha:cb0d59a4b5c4f92927b05f999d54e2e4004a7bce
  • alt-php74-mysqlnd_7.4.33-81_amd64.deb
    sha:f5932aa1717b8cd878925d9918e65e367cacdd33
  • alt-php74-odbc_7.4.33-81_amd64.deb
    sha:60e0029c0dde3bfbd3295f1d38445b0192093708
  • alt-php74-opcache_7.4.33-81_amd64.deb
    sha:4ab62140231228862f17ef0bb3e5c3cda2994f37
  • alt-php74-pdo_7.4.33-81_amd64.deb
    sha:4422f77022f1b45cdaf030a5ea51a7c951607b08
  • alt-php74-pgsql_7.4.33-81_amd64.deb
    sha:1e6434e52907dd436f1a558e10ca415ac3a1a91b
  • alt-php74-php-fpm_7.4.33-81_amd64.deb
    sha:bbffc602cb51c1fcfc38788c9ab2842ba6759789
  • alt-php74-process_7.4.33-81_amd64.deb
    sha:fe04c5e33da4a278010ed11ed5d0bb679b8efe77
  • alt-php74-pspell_7.4.33-81_amd64.deb
    sha:775f29ec1d901e247d4106835ff877f9586c5946
  • alt-php74-snmp_7.4.33-81_amd64.deb
    sha:8f1883ad97e1c23785bca6f01e271ac20a4e9ebf
  • alt-php74-soap_7.4.33-81_amd64.deb
    sha:b563d700b466cc180f7071f824ea6242c954348a
  • alt-php74-sodium_7.4.33-81_amd64.deb
    sha:020079415a71c241ddb05aa24b10ba9e3a3dbfd7
  • alt-php74-tidy_7.4.33-81_amd64.deb
    sha:302a603db30e261e904bf3c0b29e637afceccde0
  • alt-php74-xml_7.4.33-81_amd64.deb
    sha:cebd3324b787611c7619db27311575d6866b96de
  • alt-php74-xmlrpc_7.4.33-81_amd64.deb
    sha:ea3f27bc81a2354a3f9f4343f3d052cc991affc5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.