[CLSA-2026:1792602265] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 03:23:33 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-8.0-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; upstream 82f8f31b (PHP 8.0 branch) also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php80_8.0.30-70_amd64.deb
    sha:bad08b99fc119e29830c1a16ce5e6434e55700a4
  • alt-php80-bcmath_8.0.30-70_amd64.deb
    sha:97cf7b088dc29927ddc9106ea762f8537f09cfab
  • alt-php80-cli_8.0.30-70_amd64.deb
    sha:f0f8b5c1d58cb29878a44f0b36de2027a04abb16
  • alt-php80-common_8.0.30-70_amd64.deb
    sha:fea9a16dd9311c74ebfa0a7d664dc4f96da2b195
  • alt-php80-dba_8.0.30-70_amd64.deb
    sha:b2e918df273d4f58f3e26266ec5bb98dd84e8d30
  • alt-php80-dev_8.0.30-70_amd64.deb
    sha:2b7ebb17b396dda1544aa87adace700cd727ff96
  • alt-php80-enchant_8.0.30-70_amd64.deb
    sha:2d19e4c2cd31f45296801c985b581294528f4824
  • alt-php80-firebird_8.0.30-70_amd64.deb
    sha:2b36a8e7d141fc155dcf2fb13cfcb1bacae1b3aa
  • alt-php80-gd_8.0.30-70_amd64.deb
    sha:b5d3bcd201db68b503bea3d6f50fe0179ecafee7
  • alt-php80-imap_8.0.30-70_amd64.deb
    sha:d4c4693598c1db3332bfba20baffdb774ebc8157
  • alt-php80-intl_8.0.30-70_amd64.deb
    sha:a410ba9f518e2e1517566c8b07532b1aa5890e93
  • alt-php80-ldap_8.0.30-70_amd64.deb
    sha:3242426583381aab219ddcaae1d1bd7ec0d09b8c
  • alt-php80-mbstring_8.0.30-70_amd64.deb
    sha:c69b80c8db823d35ba81567c4d830a858f77f445
  • alt-php80-mysqlnd_8.0.30-70_amd64.deb
    sha:68d0d2e5f5b9bb456c991265d8c09d3a799d3649
  • alt-php80-odbc_8.0.30-70_amd64.deb
    sha:9bdff314bba1b63e3e94f82faa95feff190e0ef3
  • alt-php80-opcache_8.0.30-70_amd64.deb
    sha:cdf97bfc6f804ad0ffb1431b0ef7896ce26e5720
  • alt-php80-pdo_8.0.30-70_amd64.deb
    sha:0020876f8385a61c7b668aa1c45f1307c2d78470
  • alt-php80-pgsql_8.0.30-70_amd64.deb
    sha:01a940b134d2998ba6578fb9b921f9f465d03755
  • alt-php80-php-fpm_8.0.30-70_amd64.deb
    sha:316d5cc6a7bda72b4a34e686bb58ba5e28e093bc
  • alt-php80-process_8.0.30-70_amd64.deb
    sha:ed8055b8490cf4f93dc3d514bec59458da6dffb9
  • alt-php80-pspell_8.0.30-70_amd64.deb
    sha:3366213a8235d3edf58425815291af1173a810d9
  • alt-php80-snmp_8.0.30-70_amd64.deb
    sha:904bf43e5d406bd6b3ad8e6340254f999090bae1
  • alt-php80-soap_8.0.30-70_amd64.deb
    sha:10b96b1964375a51f90c85867cec213a7a0e4d55
  • alt-php80-sodium_8.0.30-70_amd64.deb
    sha:196b6c4caa4535c1759cabe7ad6a79d5da4d780a
  • alt-php80-tidy_8.0.30-70_amd64.deb
    sha:4774dbf57148711c709d0fd31b0e5f94144fe8e9
  • alt-php80-xml_8.0.30-70_amd64.deb
    sha:a0f5215f988e3a9a72542e38bf55709b8a85798b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.