[CLSA-2026:1792661563] Fix CVE(s): CVE-2026-109618, CVE-2026-109619
Type:
security
Severity:
Critical
Release date:
2026-10-22 09:32:54 UTC
Description:
* SECURITY UPDATE: security hardening in the memory allocator, the multipart request parser and the session upload-progress path - debian/patches/php-8.3-CVE-2026-109618-109619.patch: report allocation failures without re-entering the engine from the allocator error path, and take substring_conf()'s length as size_t rather than int, and restrict the session upload-progress handler so it no longer runs user code while it decodes and re-encodes the session mid-request (in_rfc1867_update, incomplete-classes-only serialization, a modules_activated guard and a _SESSION cleanup); upstream 3c832b52 (PHP 8.3 branch) - CVE-2026-109618 - CVE-2026-109619
CVEs fixed:
Updated packages:
  • alt-php83_8.3.35-5_amd64.deb
    sha:67c3e27d49ce29ca1eb662412924e46bdd4bfed3
  • alt-php83-bcmath_8.3.35-5_amd64.deb
    sha:ff7a30277ae653d07a3e873a0217bd5806ac0c52
  • alt-php83-cli_8.3.35-5_amd64.deb
    sha:33f7b758c67e8ebb38a5fd16c94fceb0f31684cb
  • alt-php83-common_8.3.35-5_amd64.deb
    sha:790e657e590957bd84fddedafea3ba07018c4819
  • alt-php83-dba_8.3.35-5_amd64.deb
    sha:f792356915b1124ffd6d1c6920c3a31bb2c6f624
  • alt-php83-dev_8.3.35-5_amd64.deb
    sha:e249f6b8b9ea041ab0b0c270b027b99f65bb5cdc
  • alt-php83-enchant_8.3.35-5_amd64.deb
    sha:103ebf5b494c70828c74761109d2bffbe8c276f5
  • alt-php83-firebird_8.3.35-5_amd64.deb
    sha:435b85aa2b86439a8c40d9b883a3bfa62db4f645
  • alt-php83-gd_8.3.35-5_amd64.deb
    sha:cbfbcd9281ccbbccd87d1a156a9952e305fbddca
  • alt-php83-imap_8.3.35-5_amd64.deb
    sha:495c9b7b37cdcff655a8f3cd742611608a8b77a3
  • alt-php83-intl_8.3.35-5_amd64.deb
    sha:c9f3d6ba6cb3e85babb9604febf9bf7a5b47738c
  • alt-php83-ldap_8.3.35-5_amd64.deb
    sha:6569d2b7ab2d9b6d726944baf51bc924f9b08cd9
  • alt-php83-mbstring_8.3.35-5_amd64.deb
    sha:fe118fbadbcd844f7c229ec801d90342810e28fe
  • alt-php83-mysqlnd_8.3.35-5_amd64.deb
    sha:92345df5412381b8e2bedbf5bc41eb50e1bad598
  • alt-php83-odbc_8.3.35-5_amd64.deb
    sha:4a77f2acfba6e076810af52bf12697eafe03e7f3
  • alt-php83-opcache_8.3.35-5_amd64.deb
    sha:3b8ba6015e6f0b40244d7f4320c697f739fe6a56
  • alt-php83-pdo_8.3.35-5_amd64.deb
    sha:82b42ace92f9c8fd2616ddd30f82077db515cefe
  • alt-php83-pgsql_8.3.35-5_amd64.deb
    sha:b9084c7ee4ca980e69ed0be9f22ee8e1a74dfdd9
  • alt-php83-php-fpm_8.3.35-5_amd64.deb
    sha:7826976670db3f2a5614bca012f9510637a91756
  • alt-php83-process_8.3.35-5_amd64.deb
    sha:94ee24384429f8e2d6cde777b653675086225e06
  • alt-php83-pspell_8.3.35-5_amd64.deb
    sha:011d8cf02e6b24c0230cabf9be367d8407fdd385
  • alt-php83-snmp_8.3.35-5_amd64.deb
    sha:76094ac99eaed725a2e147025521da87b550794e
  • alt-php83-soap_8.3.35-5_amd64.deb
    sha:e1aa5bee8b777d035b41b84ab30397301cddb42d
  • alt-php83-sodium_8.3.35-5_amd64.deb
    sha:6e7dddebcc19a225630cf90662e4691abff6fe83
  • alt-php83-tidy_8.3.35-5_amd64.deb
    sha:e00e0853d482bbcbf8fa3b950762ef9ce83143c6
  • alt-php83-xml_8.3.35-5_amd64.deb
    sha:08321c90519d652482d981accf1cea7d6c93aa9b
  • alt-php83_8.3.35-5_arm64.deb
    sha:a5e7ab7f98151b95f4c20c3171579d799708ba15
  • alt-php83-bcmath_8.3.35-5_arm64.deb
    sha:1b2177dd947dc0525f2bccadbf051f091f92383d
  • alt-php83-cli_8.3.35-5_arm64.deb
    sha:14326773e44cb297bb52df40efb268d550c9cf2e
  • alt-php83-common_8.3.35-5_arm64.deb
    sha:542c405264da5d21acf10eaa369f1cc9e79b18cc
  • alt-php83-dba_8.3.35-5_arm64.deb
    sha:886cfcecfd60998f76a9c8e74d19e573bf4500da
  • alt-php83-dev_8.3.35-5_arm64.deb
    sha:798ee2aeef0fbbdb79b23cbfe0d44ffecda8e91c
  • alt-php83-enchant_8.3.35-5_arm64.deb
    sha:214faafa2abfabaaab202f6cebd810412bf1bfc8
  • alt-php83-firebird_8.3.35-5_arm64.deb
    sha:bc4de3758f44a95676554efd1a714d97512d2b30
  • alt-php83-gd_8.3.35-5_arm64.deb
    sha:2cdf48947dbcaa3e8e8e8f356175f13f9255212c
  • alt-php83-imap_8.3.35-5_arm64.deb
    sha:835c562e7799352d8e342040983bca55f2866d07
  • alt-php83-intl_8.3.35-5_arm64.deb
    sha:125f87a4a8d6df6be556023778a505e742e7dfe3
  • alt-php83-ldap_8.3.35-5_arm64.deb
    sha:0fd8a04634399ebc504011adb7dba2bc77f4c39e
  • alt-php83-mbstring_8.3.35-5_arm64.deb
    sha:48727496bdd5321111dd325d491a88a8254e8192
  • alt-php83-mysqlnd_8.3.35-5_arm64.deb
    sha:5b5a7aae43997bbc673047f74fff60ce937c1924
  • alt-php83-odbc_8.3.35-5_arm64.deb
    sha:3ef3d83ee0f70b6d0726fcf0ece7161c2b1261a3
  • alt-php83-opcache_8.3.35-5_arm64.deb
    sha:a29ef8baa9651927e4e44361a9d8bf4136ac58bf
  • alt-php83-pdo_8.3.35-5_arm64.deb
    sha:b061c07eb9884e77f5aec7c256b4b363d7a9f519
  • alt-php83-pgsql_8.3.35-5_arm64.deb
    sha:e934f91da702240d024e7be58f513c62aef3216d
  • alt-php83-php-fpm_8.3.35-5_arm64.deb
    sha:8efabaa76ce68c24974cbfaf4778b3a27ef0efb0
  • alt-php83-process_8.3.35-5_arm64.deb
    sha:83e3f3a57751d4ac1deb04fb5bdb289b32e449ee
  • alt-php83-pspell_8.3.35-5_arm64.deb
    sha:c18b96475dd8d50f12d3cffe135ae1686b314d26
  • alt-php83-snmp_8.3.35-5_arm64.deb
    sha:04c1217141306b6e31a55a7d6bc1120286918a6a
  • alt-php83-soap_8.3.35-5_arm64.deb
    sha:98cc0c6216fcda74ac2359a3d898ebbed3387758
  • alt-php83-sodium_8.3.35-5_arm64.deb
    sha:638175d8965f69bb20e2cdf0a22f2f8102f73991
  • alt-php83-tidy_8.3.35-5_arm64.deb
    sha:891e8044076049fac0efa33ea580f6934f476314
  • alt-php83-xml_8.3.35-5_arm64.deb
    sha:1443a0d057916b3db11f032b4b3f87c79adc3a6c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.