[CLSA-2026:1792665703] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 17:56:31 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-8.1-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; upstream 1d7dec17 (PHP 8.1 branch) also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-39_amd64.deb
    sha:e33965a83e3d248066184b77ec80af45f5d87773
  • alt-php81-bcmath_8.1.34-39_amd64.deb
    sha:f40176978bab3f6337f8ae2f5081c9f6298393f1
  • alt-php81-cli_8.1.34-39_amd64.deb
    sha:d58f3eabb6f31df7dfe44aac8b254a8720c351c6
  • alt-php81-common_8.1.34-39_amd64.deb
    sha:d721dc9481caaeaa7f85580c59a52157d8811fe3
  • alt-php81-dba_8.1.34-39_amd64.deb
    sha:55be0dc27e04b92439172767276acda2f87e7c89
  • alt-php81-dev_8.1.34-39_amd64.deb
    sha:d833e66e4bd260a9c9c22a269a718986e8c523b2
  • alt-php81-enchant_8.1.34-39_amd64.deb
    sha:30c28e759283815446ad0802a09e473b88acfc88
  • alt-php81-firebird_8.1.34-39_amd64.deb
    sha:00c7e041e5c50200baeeb7939cecbaf78a4d69be
  • alt-php81-gd_8.1.34-39_amd64.deb
    sha:44af916b8ad2d2667ffca3fc8e75a4c6a133885f
  • alt-php81-imap_8.1.34-39_amd64.deb
    sha:1ed81a418343f19f010cb014470eacea56c254c6
  • alt-php81-intl_8.1.34-39_amd64.deb
    sha:5032a1968ec0da277cfdb50442981da230dbcb59
  • alt-php81-ldap_8.1.34-39_amd64.deb
    sha:0151e069c68a4d97fd82bd31b2ebe6fc51ecf361
  • alt-php81-mbstring_8.1.34-39_amd64.deb
    sha:b86f96ff4e221fac17a84902bcf3b61ce84bf215
  • alt-php81-mysqlnd_8.1.34-39_amd64.deb
    sha:33a5a9875cd1e89dff359f84a83a292051b10704
  • alt-php81-odbc_8.1.34-39_amd64.deb
    sha:b3db337fa2c96cbb87770ce36a07fddc061c1b8b
  • alt-php81-opcache_8.1.34-39_amd64.deb
    sha:ccbe06610153927b2fb2283b678a96f25a120d0f
  • alt-php81-pdo_8.1.34-39_amd64.deb
    sha:96ab9c17bfa5183c9a261daa4b46276feddf249c
  • alt-php81-pgsql_8.1.34-39_amd64.deb
    sha:1bc0a82789432ba9f3d0231142a32b225758b6c2
  • alt-php81-php-fpm_8.1.34-39_amd64.deb
    sha:3f1206fdb10280ddb3c2b379eb0260caf765ad69
  • alt-php81-process_8.1.34-39_amd64.deb
    sha:1245fb62e28237977c5b8edd3d8515362ecf4f75
  • alt-php81-pspell_8.1.34-39_amd64.deb
    sha:fd6bffaf8c511f3aea64d03cab9c175a5821af7e
  • alt-php81-snmp_8.1.34-39_amd64.deb
    sha:dc25a2b144c22c0d4104e82ccdd37b0db95fb146
  • alt-php81-soap_8.1.34-39_amd64.deb
    sha:5bc758dff4b2e9a4cd83fd0a75c22e261da087fd
  • alt-php81-sodium_8.1.34-39_amd64.deb
    sha:82dbd6884a6496be043aae36893323b121b92574
  • alt-php81-tidy_8.1.34-39_amd64.deb
    sha:ecd3bf2d569a0bf2c36195875b5c7f2f4ea3f7d5
  • alt-php81-xml_8.1.34-39_amd64.deb
    sha:373b8b52d5645ee3997b5b22f1e661e9558c5b90
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.