{"id":"CLSA-2026-1791822829","summary":"php: Fix of 5 CVEs","details":"- CVE-2025-14181: fix 32-bit length overflow in the SOAP HTTP client by using\n  overflow-checked zend_string_safe_alloc()/zend_string_safe_realloc() growth in\n  get_http_body() and make_http_soap_request() in ext/soap/php_http.c\n  (GHSA-cj93-vc83-wgqv); add regression test\n  ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt\n- CVE-2026-6103: fix phar tar entry injection by rejecting unparsable or\n  unrepresentable entry sizes and skipping the data blocks of every entry type\n  that carries data in ext/phar/tar.c and ext/phar/phar_internal.h\n  (GHSA-j3wh-g957-2m85); add three regression tests under ext/phar/tests/tar\n- CVE-2026-91765: fix unbounded recursion in SOAP XML parsing and decoding by\n  bounding nesting depth in ext/soap/php_encoding.c, php_xml.c, soap.c and\n  php_soap.h (GHSA-rgrp-mwpx-f6rm); add regression tests under ext/soap/tests\n- CVE-2026-91766: strip Authorization, Cookie and Proxy-Authorization from\n  user-supplied headers on cross-origin redirects in\n  ext/standard/http_fopen_wrapper.c (GHSA-fpwc-w8rq-cr92); add regression test\n  ext/standard/tests/http/ghsa-fpwc-w8rq-cr92.phpt and update the pre-existing\n  ext/standard/tests/http/bug61548.phpt expectation as upstream did\n- CVE-2026-91769: do not fall back to matching the certificate CN when the\n  certificate presents a DNS-ID, SRV-ID or URI-ID subjectAltName, per RFC 6125\n  6.4.4, in ext/openssl/xp_ssl.c (GHSA-vvx9-73fr-5jjx); add regression tests\n  under ext/openssl/tests and update the pre-existing san_peer_matching.phpt\n  expectation as upstream did","modified":"2026-10-26T09:30:39.104403088Z","published":"2026-10-12T16:34:03Z","upstream":["CVE-2025-14181","CVE-2026-6103","CVE-2026-91765","CVE-2026-91766","CVE-2026-91769"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791822829.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769"}],"affected":[{"package":{"name":"php","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-bcmath","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-bcmath?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-cli","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-cli?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-common","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-common?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-dba","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-dba?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-dbg","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-dbg?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-embedded","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-embedded?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-enchant","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-enchant?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-ffi","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-ffi?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-fpm","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-fpm?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-gd","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-gd?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-gmp","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-gmp?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-intl","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-intl?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-ldap","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-ldap?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-mbstring","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-mbstring?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-mysqlnd","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-mysqlnd?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-odbc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-odbc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-opcache","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-opcache?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-pdo","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-pdo?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-pgsql","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-pgsql?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-process","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-process?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-snmp","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-snmp?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-soap","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-soap?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}},{"package":{"name":"php-xml","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-xml?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791822829.json"}}],"schema_version":"1.9.0"}