[CLSA-2026:1792661301] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 09:28:32 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - debian/patches/php-8.3-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int, and restrict the session upload-progress handler so it no longer runs user code while it decodes and re-encodes the session mid-request (in_rfc1867_update, incomplete-classes-only serialization, a modules_activated guard and a _SESSION cleanup); upstream 3c832b52 (PHP 8.3 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php83_8.3.35-5_amd64.deb
    sha:6dc8813df29c63fe275d7448ecf0fe9a77464f40
  • alt-php83-bcmath_8.3.35-5_amd64.deb
    sha:88e310db4070d92d2d308fd3c2636263c6e91dcb
  • alt-php83-cli_8.3.35-5_amd64.deb
    sha:bd0edbdbd62a541e798bafb8da2ea27a8efee8a6
  • alt-php83-common_8.3.35-5_amd64.deb
    sha:435b78d9bdf71516e7d730052e419ad6f67e3b7b
  • alt-php83-dba_8.3.35-5_amd64.deb
    sha:43d7668648e4059f521c43a7b624ba2b817838a7
  • alt-php83-dev_8.3.35-5_amd64.deb
    sha:33dd0d0215f7a1550c8e5f84148368a64b92f6db
  • alt-php83-enchant_8.3.35-5_amd64.deb
    sha:b199277e426ea3732d96f254bc50214302c2041a
  • alt-php83-firebird_8.3.35-5_amd64.deb
    sha:1dd10a4f70cf4b73ffb6c67206130f159a02b9e5
  • alt-php83-gd_8.3.35-5_amd64.deb
    sha:8a2b616056106cfaf1584519ed8bdb4fa58c84bf
  • alt-php83-imap_8.3.35-5_amd64.deb
    sha:3406bc42cde46051322508d756b0a6ff0be7a2f8
  • alt-php83-intl_8.3.35-5_amd64.deb
    sha:bc918ec0fd793b3bb5271265d2bb7c58c6263419
  • alt-php83-ldap_8.3.35-5_amd64.deb
    sha:2f7f4af1d59759435fac3aaaf114e7624738e72f
  • alt-php83-mbstring_8.3.35-5_amd64.deb
    sha:0d25b75fb6af1d94b1ca5b318dc8b0ed73ad0baf
  • alt-php83-mysqlnd_8.3.35-5_amd64.deb
    sha:a68d22c4eb63d609efb15583b6911444dda7bfb6
  • alt-php83-odbc_8.3.35-5_amd64.deb
    sha:aaf852efd297a0e9404b45219263b164ab5f3dc7
  • alt-php83-opcache_8.3.35-5_amd64.deb
    sha:8bd8cb9f91002c0daf41339d42e034c0f46e7ebe
  • alt-php83-pdo_8.3.35-5_amd64.deb
    sha:c5c695d60fa27afde481031cc33013aba2fa1b8a
  • alt-php83-pgsql_8.3.35-5_amd64.deb
    sha:f4de600a811d0710bbd8f04bb5876b27cbfee15a
  • alt-php83-php-fpm_8.3.35-5_amd64.deb
    sha:50eb4292c266959905b14b1305679ef8dcfa388b
  • alt-php83-process_8.3.35-5_amd64.deb
    sha:e702648940dac95008654dee285ca59b05f06d8a
  • alt-php83-pspell_8.3.35-5_amd64.deb
    sha:de0bfaa24e360a9f347f59d23114b7f4e66c0cd2
  • alt-php83-snmp_8.3.35-5_amd64.deb
    sha:4dc4192f53b9443076c15f2d18199c43f47c1be0
  • alt-php83-soap_8.3.35-5_amd64.deb
    sha:3895a534e7ad7aea63624a258dcd071dae214ecb
  • alt-php83-sodium_8.3.35-5_amd64.deb
    sha:08c27ac1b2369bccd6d3afe574b2d7b0927134bb
  • alt-php83-tidy_8.3.35-5_amd64.deb
    sha:d0cb7e37de093d9345849c93859b8c5d356e3928
  • alt-php83-xml_8.3.35-5_amd64.deb
    sha:8e27de2adfef6570fa30342851f3ea413aae80fa
  • alt-php83_8.3.35-5_arm64.deb
    sha:a00710d5524167118b726a28b0c092f002e4802c
  • alt-php83-bcmath_8.3.35-5_arm64.deb
    sha:710598b6401bca6904bf4273e9922e1596d89888
  • alt-php83-cli_8.3.35-5_arm64.deb
    sha:8416abd1459894a8b72e819160eae039a2b3ece1
  • alt-php83-common_8.3.35-5_arm64.deb
    sha:e2706abe83214647a109185d6abb77a644f33395
  • alt-php83-dba_8.3.35-5_arm64.deb
    sha:e9662556b8d58db64a14fdb72af2c7b08e3c7837
  • alt-php83-dev_8.3.35-5_arm64.deb
    sha:8b0c809eba4235f03d27a94967f57a40a92e3c4f
  • alt-php83-enchant_8.3.35-5_arm64.deb
    sha:351dc48cc31296af01082aabb7b26c2af24acf5c
  • alt-php83-firebird_8.3.35-5_arm64.deb
    sha:5ccd4f08be9c33200b273885bffe7a62087cf02c
  • alt-php83-gd_8.3.35-5_arm64.deb
    sha:38df1794a35fd132d187a04663138829ce31b720
  • alt-php83-imap_8.3.35-5_arm64.deb
    sha:bd57f63c4b3449286ba64cc5e0857d05c2ab8b7c
  • alt-php83-intl_8.3.35-5_arm64.deb
    sha:9267b1cf2950c598eafa51c1fd661d2218cc9d15
  • alt-php83-ldap_8.3.35-5_arm64.deb
    sha:95a5e6b8c80e696ea9335e4370cb4d64d12c27aa
  • alt-php83-mbstring_8.3.35-5_arm64.deb
    sha:1fd87bd94a258f3f35d7ef0b252049469d676720
  • alt-php83-mysqlnd_8.3.35-5_arm64.deb
    sha:46505a6d7478cb389447f60ec39667d2fbe11927
  • alt-php83-odbc_8.3.35-5_arm64.deb
    sha:a6e76752035080cf6084d8c6d31392d316ccf482
  • alt-php83-opcache_8.3.35-5_arm64.deb
    sha:e5fac742242f403848b892d85db82faf5a8e759d
  • alt-php83-pdo_8.3.35-5_arm64.deb
    sha:c9284cd2bff9b04577d67c9953c49794f8f30203
  • alt-php83-pgsql_8.3.35-5_arm64.deb
    sha:02f67f341c39207171ba620dd93bebdc242341e6
  • alt-php83-php-fpm_8.3.35-5_arm64.deb
    sha:3945ba582a56d6606fd70aee45707ac5aeac4d57
  • alt-php83-process_8.3.35-5_arm64.deb
    sha:64e4043be1e06f33dd0f5d9724529efe1752fcd0
  • alt-php83-pspell_8.3.35-5_arm64.deb
    sha:65b22337f651329b7e75fea1232af24c998cd052
  • alt-php83-snmp_8.3.35-5_arm64.deb
    sha:d2cb6a768563e0da1c9e3e880a906fa43daaf92d
  • alt-php83-soap_8.3.35-5_arm64.deb
    sha:b64907ad9ad38a4e038ff255713c4a83fd4741b9
  • alt-php83-sodium_8.3.35-5_arm64.deb
    sha:83dc3bc174b4d892f10aa6f4ca51772abfef39ba
  • alt-php83-tidy_8.3.35-5_arm64.deb
    sha:405307da7dd928203ef1c0d27913362b634da68d
  • alt-php83-xml_8.3.35-5_arm64.deb
    sha:2471c40649844aec90c302ca06e0757763a521e1
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.