[CLSA-2026:1792663876] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 10:11:27 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - debian/patches/php-8.3-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int, and restrict the session upload-progress handler so it no longer runs user code while it decodes and re-encodes the session mid-request (in_rfc1867_update, incomplete-classes-only serialization, a modules_activated guard and a _SESSION cleanup); upstream 3c832b52 (PHP 8.3 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php83_8.3.35-5_amd64.deb
    sha:4f195a1a91a99e4e239597a3bbedfbbe05486d99
  • alt-php83-bcmath_8.3.35-5_amd64.deb
    sha:2da0f40e220e731b7e5caab1f3e4cd42d49bffcd
  • alt-php83-cli_8.3.35-5_amd64.deb
    sha:b9d724e8a684b1b2b4579d3d703e6c244b696f18
  • alt-php83-common_8.3.35-5_amd64.deb
    sha:79582431d5115f4b8f051bafdb792aef1a1e6530
  • alt-php83-dba_8.3.35-5_amd64.deb
    sha:b5ab49d22f22bf6bead5ca4ca0c2c5d606bcd3cb
  • alt-php83-dev_8.3.35-5_amd64.deb
    sha:984d40bbc4f7b790d81703b4d5a7dddca9c3d27d
  • alt-php83-enchant_8.3.35-5_amd64.deb
    sha:bccc6bfd2b9e3ad1385fd5b808fb51ec625b38a9
  • alt-php83-firebird_8.3.35-5_amd64.deb
    sha:98a51b2b08c6b90eedc54902fa2aced41afb31cb
  • alt-php83-gd_8.3.35-5_amd64.deb
    sha:34ccde37eb4a5a43f27d323e1cf2de9584bdc7c3
  • alt-php83-imap_8.3.35-5_amd64.deb
    sha:2e5bad56c01d34948367ed7045fcb4fb32abdeac
  • alt-php83-intl_8.3.35-5_amd64.deb
    sha:ccbfd40bc45c82d1b02fdeefa8ed8c60ce2c17d2
  • alt-php83-ldap_8.3.35-5_amd64.deb
    sha:e333fced486c752dd3d3bb9bc543aae620875ae7
  • alt-php83-mbstring_8.3.35-5_amd64.deb
    sha:320a5b943ee6cece6fe2c1c4dd3a00e0571df097
  • alt-php83-mysqlnd_8.3.35-5_amd64.deb
    sha:63429382ed830f5119ffe3951b9bd9ad01a8bd1d
  • alt-php83-odbc_8.3.35-5_amd64.deb
    sha:766dea1a064ab9fd56e4ea05d5fd0dd0d45c05ee
  • alt-php83-opcache_8.3.35-5_amd64.deb
    sha:461c24e8bec61ea68f78cdaf5b81e9b7924faa80
  • alt-php83-pdo_8.3.35-5_amd64.deb
    sha:84c31708db937b053d8b10f76acee938111906f3
  • alt-php83-pgsql_8.3.35-5_amd64.deb
    sha:847d64b01f9534f980d097b2088fcbba5882f8dc
  • alt-php83-php-fpm_8.3.35-5_amd64.deb
    sha:8005ff0b4b66ef45f8849d0da35360546b21e764
  • alt-php83-process_8.3.35-5_amd64.deb
    sha:2bdfbf1e5720ceb1dc2d1adcd152c3436f3082a0
  • alt-php83-pspell_8.3.35-5_amd64.deb
    sha:544bb39fa29e2acc0107bdbd5609f610503e9650
  • alt-php83-snmp_8.3.35-5_amd64.deb
    sha:a4775f5f90fd55c5d08cf123a2604264066406d5
  • alt-php83-soap_8.3.35-5_amd64.deb
    sha:3ffb4aa6d6d14522e1dea29fdbff8919c08b614f
  • alt-php83-sodium_8.3.35-5_amd64.deb
    sha:1fbf88a0192729ffbab0ff5c5c391a2d0034dfb0
  • alt-php83-tidy_8.3.35-5_amd64.deb
    sha:0a28d33163a7bc1ee513e31fa95a8dc172637b3d
  • alt-php83-xml_8.3.35-5_amd64.deb
    sha:8b4c2dec57af2038602d2dfab8cabdde95ecec1d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.