[CLSA-2026:1792664073] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 10:14:44 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - debian/patches/php-8.3-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int, and restrict the session upload-progress handler so it no longer runs user code while it decodes and re-encodes the session mid-request (in_rfc1867_update, incomplete-classes-only serialization, a modules_activated guard and a _SESSION cleanup); upstream 3c832b52 (PHP 8.3 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php83_8.3.35-5_amd64.deb
    sha:4f195a1a91a99e4e239597a3bbedfbbe05486d99
  • alt-php83-bcmath_8.3.35-5_amd64.deb
    sha:acdd0c26ee3b95447623352470c97ef6cbd1b40e
  • alt-php83-cli_8.3.35-5_amd64.deb
    sha:5abf0418fe41654a724c7f0dccf2f935d71dc6dd
  • alt-php83-common_8.3.35-5_amd64.deb
    sha:85bf60837221ec88ed2ec28727905bf60cb1df05
  • alt-php83-dba_8.3.35-5_amd64.deb
    sha:613135d441dfec180510fe57b65129d3cf200b84
  • alt-php83-dev_8.3.35-5_amd64.deb
    sha:229bdcf19c2b5cc749703a16e2d28ed9cf0dc021
  • alt-php83-enchant_8.3.35-5_amd64.deb
    sha:a7e727881c4547a3f38c59605a2c1992e271b8b8
  • alt-php83-firebird_8.3.35-5_amd64.deb
    sha:2af2b7a0da9956d311b4b0fe91677cd98fec9847
  • alt-php83-gd_8.3.35-5_amd64.deb
    sha:8fa3e6f79579f3ec972091751a8dad45b67c4f90
  • alt-php83-imap_8.3.35-5_amd64.deb
    sha:1c3c828ac91c8bb9c51ce0e5f7cbc8ce9826b9a1
  • alt-php83-intl_8.3.35-5_amd64.deb
    sha:221dadc9ddcf3d651529bef923faf556aef750be
  • alt-php83-ldap_8.3.35-5_amd64.deb
    sha:16b13fdbb008962c39833ef6282ddd01d6ab591a
  • alt-php83-mbstring_8.3.35-5_amd64.deb
    sha:a20ee658d945f2963d6578430d8039cb2c67b160
  • alt-php83-mysqlnd_8.3.35-5_amd64.deb
    sha:81280e7ddea591ebb1c5b152268b6e4c42a46c62
  • alt-php83-odbc_8.3.35-5_amd64.deb
    sha:84fbee7b794edda27c619b4fd46f553d0bb56783
  • alt-php83-opcache_8.3.35-5_amd64.deb
    sha:e5af87322f7a9a7c1b4626124bef9bc73c35269d
  • alt-php83-pdo_8.3.35-5_amd64.deb
    sha:a9e48391c57893c6b22f228959e23dcebeb95de7
  • alt-php83-pgsql_8.3.35-5_amd64.deb
    sha:48458a38193608af6927cf3c0f6289a6dd4b0016
  • alt-php83-php-fpm_8.3.35-5_amd64.deb
    sha:908df2bc1a4a634d2700af227a96b3d41c7ab870
  • alt-php83-process_8.3.35-5_amd64.deb
    sha:978ce38f97c64b336f3000e813210f1228f8e00c
  • alt-php83-pspell_8.3.35-5_amd64.deb
    sha:542671cfaff8520309f8a68476f572b2b7209634
  • alt-php83-snmp_8.3.35-5_amd64.deb
    sha:dd86ffca0ff12fdbae88a4ef54d8ade3cc0d38f8
  • alt-php83-soap_8.3.35-5_amd64.deb
    sha:80e3e333fcda04a85356d3ae755ef755ba95b8b7
  • alt-php83-sodium_8.3.35-5_amd64.deb
    sha:64095c2eb493eafeee24ecdb3027e223d8c47e03
  • alt-php83-tidy_8.3.35-5_amd64.deb
    sha:d2f3289833bb575c91fbd378d39d4df52d807b33
  • alt-php83-xml_8.3.35-5_amd64.deb
    sha:c1a8bd4f7ad0f90b197c1e9e26dfaed79d7c62b1
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.