[CLSA-2026:1792602669] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-21 17:11:37 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-8.0-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; upstream 82f8f31b (PHP 8.0 branch) also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php80_8.0.30-70_amd64.deb
    sha:bad08b99fc119e29830c1a16ce5e6434e55700a4
  • alt-php80-bcmath_8.0.30-70_amd64.deb
    sha:7786618bde3bef317ce706f0159cbb053384eb40
  • alt-php80-cli_8.0.30-70_amd64.deb
    sha:6e2a65eb73a6763c123145b566427190ef971a81
  • alt-php80-common_8.0.30-70_amd64.deb
    sha:c88daab653d57c847d62e595fa9258739ede5655
  • alt-php80-dba_8.0.30-70_amd64.deb
    sha:38191749206a0ccc13e3e407c37b720c790ff3cd
  • alt-php80-dev_8.0.30-70_amd64.deb
    sha:15e8467b7865f9e5a0acc9efd02a44699c581bb7
  • alt-php80-enchant_8.0.30-70_amd64.deb
    sha:27434401a4bd1f255ca8506eee256c1e49e12a3e
  • alt-php80-firebird_8.0.30-70_amd64.deb
    sha:3a8859aaff22c56686e4740eecb031c320d03109
  • alt-php80-gd_8.0.30-70_amd64.deb
    sha:df91d15d713d32fe8f23371bc81f9bdeda1e8a00
  • alt-php80-imap_8.0.30-70_amd64.deb
    sha:abad1a322146e593aaa1d42a37d02073fe7107a1
  • alt-php80-intl_8.0.30-70_amd64.deb
    sha:1e65ae1d29305ff8c0223748435ea83002bde94d
  • alt-php80-ldap_8.0.30-70_amd64.deb
    sha:96255391d9bacae8be95f2feb27b239bbbaf57f4
  • alt-php80-mbstring_8.0.30-70_amd64.deb
    sha:cdc0aa2203499647854edae3e466932883893380
  • alt-php80-mysqlnd_8.0.30-70_amd64.deb
    sha:b8972e2a5088c2a4fac3f5a8babac5e04235d93b
  • alt-php80-odbc_8.0.30-70_amd64.deb
    sha:3ff14d30b648f02a283d07403afbf3af6a50a608
  • alt-php80-opcache_8.0.30-70_amd64.deb
    sha:bce9b2e7fc0681719fcc9d64865a7001419ea345
  • alt-php80-pdo_8.0.30-70_amd64.deb
    sha:632de2242327dfcad17451bdcc6f4e9680d0ff32
  • alt-php80-pgsql_8.0.30-70_amd64.deb
    sha:d082805c630249842bda4b7bccbf55dfc163b413
  • alt-php80-php-fpm_8.0.30-70_amd64.deb
    sha:2ced72398ad938230ea76ebeeb54cd88279e31f1
  • alt-php80-process_8.0.30-70_amd64.deb
    sha:7dec87a64c56ce6b25100840a53e990b8da565b8
  • alt-php80-pspell_8.0.30-70_amd64.deb
    sha:f737e9c5b084a0957ac55444e4ad8fa9dadab6a6
  • alt-php80-snmp_8.0.30-70_amd64.deb
    sha:bfd9dde917c57e63b709c526baba945cb584320b
  • alt-php80-soap_8.0.30-70_amd64.deb
    sha:7e8f06075c8c1f2fb648ae71a5d06f0195065954
  • alt-php80-sodium_8.0.30-70_amd64.deb
    sha:d6371d26a55879ddab0f4a47d7c90bf2e7ca0724
  • alt-php80-tidy_8.0.30-70_amd64.deb
    sha:bcbef8e1ee45a50849ce262dfc24a0b39f61d6fe
  • alt-php80-xml_8.0.30-70_amd64.deb
    sha:4d15e153d97f0662917565da3bf1272e4cf35e6b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.