[CLSA-2026:1792665909] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 10:45:22 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator and the multipart request parser - debian/patches/php-8.1-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int; upstream 1d7dec17 (PHP 8.1 branch) also disables the session upload-progress callback as upstream does on the EOL branches, so session.upload_progress.enabled no longer has any effect - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-39_amd64.deb
    sha:e33965a83e3d248066184b77ec80af45f5d87773
  • alt-php81-bcmath_8.1.34-39_amd64.deb
    sha:b3be9f14092d81e1d303f9f9c4920095dbd248f9
  • alt-php81-cli_8.1.34-39_amd64.deb
    sha:b83b4130facdd4c363824ff2a44ee1bbbfd6b6b4
  • alt-php81-common_8.1.34-39_amd64.deb
    sha:a49e0f962b9815f4be36b0c86a94cd8c199944ef
  • alt-php81-dba_8.1.34-39_amd64.deb
    sha:902f93aebfa940ea52c8813aaa79f4a7366ac908
  • alt-php81-dev_8.1.34-39_amd64.deb
    sha:b99a4490302e173623636b01cf0ddc412190a448
  • alt-php81-enchant_8.1.34-39_amd64.deb
    sha:4e01317c3f93eb346bc360a5091efada5d382aa8
  • alt-php81-firebird_8.1.34-39_amd64.deb
    sha:e3b3a9bcf3b3e7b88f58fb5503677098d72e45ac
  • alt-php81-gd_8.1.34-39_amd64.deb
    sha:c11ad1e0afa74c8837556296cc0817110fa0a016
  • alt-php81-imap_8.1.34-39_amd64.deb
    sha:065ff54e911209689878a2fa3c8129a444d94138
  • alt-php81-intl_8.1.34-39_amd64.deb
    sha:e2d1207ac72914fc4f513204c7c628811f3b7919
  • alt-php81-ldap_8.1.34-39_amd64.deb
    sha:053c33a39629d724b1d8af9eed8f981b1266311e
  • alt-php81-mbstring_8.1.34-39_amd64.deb
    sha:15d868dbdcb5b7631fb5ac75a8d28bcf671f4f23
  • alt-php81-mysqlnd_8.1.34-39_amd64.deb
    sha:56674ab5039a0246ace297731cede6d503603834
  • alt-php81-odbc_8.1.34-39_amd64.deb
    sha:7c99321435df68080f5a29270e7e037b2fdf42eb
  • alt-php81-opcache_8.1.34-39_amd64.deb
    sha:2e084638c64110574bb8521dfb2f3003efffb18e
  • alt-php81-pdo_8.1.34-39_amd64.deb
    sha:6e046d2717a02ef5db18e3b73fcee52507fade76
  • alt-php81-pgsql_8.1.34-39_amd64.deb
    sha:a13916d1db812034e6b12c2b17405b9a91af013b
  • alt-php81-php-fpm_8.1.34-39_amd64.deb
    sha:f56f4045a7781fc457b4faa8391e8ec9a4b0abcc
  • alt-php81-process_8.1.34-39_amd64.deb
    sha:fee7e8281e890ba89a85b1dddd4e40ef0ef5dea4
  • alt-php81-pspell_8.1.34-39_amd64.deb
    sha:5fef855f9567e5a81b41c2975b5d1eb28bbdbd38
  • alt-php81-snmp_8.1.34-39_amd64.deb
    sha:5e104bf5a018e5e2411d3e82246cb2a8e879a89f
  • alt-php81-soap_8.1.34-39_amd64.deb
    sha:cbd14ed68c00389ce51f8517c0b532c3d03af69f
  • alt-php81-sodium_8.1.34-39_amd64.deb
    sha:5f2b5295ad970dc08bb1cefe9cc8734bb4f916cb
  • alt-php81-tidy_8.1.34-39_amd64.deb
    sha:dbbcc55f5d6339e06d8cd0a4d0b606b1c495b07e
  • alt-php81-xml_8.1.34-39_amd64.deb
    sha:e3da156aef163375198ca7c8d09eea6a85ca0e3c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.