[CLSA-2026:1792667743] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 11:15:54 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - debian/patches/php-8.2-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int, and restrict the session upload-progress handler so it no longer runs user code while it decodes and re-encodes the session mid-request (in_rfc1867_update, incomplete-classes-only serialization, a modules_activated guard and a _SESSION cleanup); upstream 01a40e89 (PHP 8.2 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php82_8.2.34-6_amd64.deb
    sha:a966fc06bee45fe87ff7807d30ca63f53dbc7495
  • alt-php82-bcmath_8.2.34-6_amd64.deb
    sha:f2dff4e2fdff2b0289d7ffa397bd165fee511455
  • alt-php82-cli_8.2.34-6_amd64.deb
    sha:0fd81148edb8c4856cdaa399b2a1325ed95c2ce0
  • alt-php82-common_8.2.34-6_amd64.deb
    sha:1208470f4443ed29bd437d6132962edfc33ad115
  • alt-php82-dba_8.2.34-6_amd64.deb
    sha:105244d9591472e115df9889ef5c0f643ff2d33b
  • alt-php82-dev_8.2.34-6_amd64.deb
    sha:535042cc8f38647d32b7148c8493de94171c6571
  • alt-php82-enchant_8.2.34-6_amd64.deb
    sha:64873f11b97291bff69a1b2bef3aefdea8efdea5
  • alt-php82-firebird_8.2.34-6_amd64.deb
    sha:3a2a514ca1c8567439d825a5800002fbc4c53126
  • alt-php82-gd_8.2.34-6_amd64.deb
    sha:b1c2b328d2cfca271f32b0c9d5d89f239f131203
  • alt-php82-imap_8.2.34-6_amd64.deb
    sha:9c8a56aa1e9c210ce5dac5254dff3e585bd67ecf
  • alt-php82-intl_8.2.34-6_amd64.deb
    sha:5cd9274452de1f3e448292456557996d25208f2a
  • alt-php82-ldap_8.2.34-6_amd64.deb
    sha:85824c4b54bb7db7657ab5997602df8e81d25296
  • alt-php82-mbstring_8.2.34-6_amd64.deb
    sha:5d74b4223019752ce970a2f89378145e1705742f
  • alt-php82-mysqlnd_8.2.34-6_amd64.deb
    sha:9817666b266aa3bd880b18d3a9bb7595186fdf60
  • alt-php82-odbc_8.2.34-6_amd64.deb
    sha:568342e7c5688938196586893e5b64344591ee56
  • alt-php82-opcache_8.2.34-6_amd64.deb
    sha:47f16299530df6753db654b87b20369bc6e21547
  • alt-php82-pdo_8.2.34-6_amd64.deb
    sha:46a83eacefc042b2a9b968f19eca88fadfd63374
  • alt-php82-pgsql_8.2.34-6_amd64.deb
    sha:dad3cc97b207ebf8818feebf39178e845b58a994
  • alt-php82-php-fpm_8.2.34-6_amd64.deb
    sha:21ca98faf66dad9d7709f0422d755d66ba4cfb85
  • alt-php82-process_8.2.34-6_amd64.deb
    sha:7884cecdfb60bbde1073184493da834b3792d415
  • alt-php82-pspell_8.2.34-6_amd64.deb
    sha:ba4214eff73c3e94447eb1a2d066928a7c6ccad8
  • alt-php82-snmp_8.2.34-6_amd64.deb
    sha:1f018a2525c63d6fc7a43f27ec70aa7d5b424dfc
  • alt-php82-soap_8.2.34-6_amd64.deb
    sha:452f6e466711e175e51ecabc99ad80a6acc7f900
  • alt-php82-sodium_8.2.34-6_amd64.deb
    sha:c49e67d9b147dcf76595d51f191e9896c88413bb
  • alt-php82-tidy_8.2.34-6_amd64.deb
    sha:f3e6a8332aff0796be82b8b464a7a7a7adab136f
  • alt-php82-xml_8.2.34-6_amd64.deb
    sha:29e1accaff176fb33da3978f7ba16173adcdcb8d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.