[CLSA-2026:1792596364] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 16:59:06 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-7.4-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; upstream 712e60f9 (PHP 7.4 branch) also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php74_7.4.33-81_amd64.deb
    sha:f1535a730389fb649c3a2e0deaa538c4966a43d3
  • alt-php74-bcmath_7.4.33-81_amd64.deb
    sha:9f2e79421a9b93dc224ba9a8b6e1367d3c0a525a
  • alt-php74-cli_7.4.33-81_amd64.deb
    sha:9b09d83430a61db3f08c3a505e4465064d009e1e
  • alt-php74-common_7.4.33-81_amd64.deb
    sha:a17b87f1516864c32c435e6b1820b8297db43d5f
  • alt-php74-dba_7.4.33-81_amd64.deb
    sha:b6bac678aeb091f70854f7c62fea0dcaa09b5cb4
  • alt-php74-dev_7.4.33-81_amd64.deb
    sha:fb754339f5003175dd0696ef81c31d0e9bb226b9
  • alt-php74-enchant_7.4.33-81_amd64.deb
    sha:b16cc22d90f761eabcd702e18e1a7f7a858c7c17
  • alt-php74-firebird_7.4.33-81_amd64.deb
    sha:9c47ef7bc256ef43b1d0f689c399dff6476bbf6a
  • alt-php74-gd_7.4.33-81_amd64.deb
    sha:f247204e937c5ae3a8317d1210fb906b7c3bc0dd
  • alt-php74-imap_7.4.33-81_amd64.deb
    sha:760a7044055c96cc62193d0715225b482d3438b8
  • alt-php74-intl_7.4.33-81_amd64.deb
    sha:7e8c9b79bac62a286250a52c199c5ac408d9d66f
  • alt-php74-ldap_7.4.33-81_amd64.deb
    sha:f4066f124cc998a113ed65945d026cc68c2eaaee
  • alt-php74-mbstring_7.4.33-81_amd64.deb
    sha:81a534c469e622a5e0dff5862604759b2357b119
  • alt-php74-mysqlnd_7.4.33-81_amd64.deb
    sha:5266beaf3471f522aee0343daa95ce764f610e44
  • alt-php74-odbc_7.4.33-81_amd64.deb
    sha:9aa72d4b69f672badabcfb5cca160665cd8c0f97
  • alt-php74-opcache_7.4.33-81_amd64.deb
    sha:3a63861e271e232aba876bd033f64dc00bc4f4bf
  • alt-php74-pdo_7.4.33-81_amd64.deb
    sha:90fb3e917bec9b6e2f301e27b55e4a88538ba9a7
  • alt-php74-pgsql_7.4.33-81_amd64.deb
    sha:518293e43901189810011fa8eea9f83f64e6a978
  • alt-php74-php-fpm_7.4.33-81_amd64.deb
    sha:3a4d328b06af3bf32d84418fbc2dcf9c67fe3aa8
  • alt-php74-process_7.4.33-81_amd64.deb
    sha:96cbf01f8896ef98155801f40c8f612a3e2d7ff2
  • alt-php74-pspell_7.4.33-81_amd64.deb
    sha:3c87e10499a9cb064aac920deeac381872d8b59c
  • alt-php74-snmp_7.4.33-81_amd64.deb
    sha:7c23a23c521a0bd3dfbdb15bc7e40f17931df4d7
  • alt-php74-soap_7.4.33-81_amd64.deb
    sha:1089a67a7300aa885b8b8eb566cc48c823467933
  • alt-php74-sodium_7.4.33-81_amd64.deb
    sha:e082acc75fd350006ca731c3d91ffd7c9ab1b9df
  • alt-php74-tidy_7.4.33-81_amd64.deb
    sha:31a26e08a50492f62985eaa13fe5f5957d3aa98c
  • alt-php74-xml_7.4.33-81_amd64.deb
    sha:2ebfa777ec80849149536009d132dc0730240da6
  • alt-php74-xmlrpc_7.4.33-81_amd64.deb
    sha:7e89bd6a736f1dd4caec69f0c4201a7c491efd0d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.