{"id":"CLSA-2026-1791900710","summary":"php: Fix of 5 CVEs","details":"- CVE-2026-91768: fix FastCGI allowed_clients comparing only the first 96 bits\n  of an IPv6 address in main/fastcgi.c (GHSA-62xp-839h-2637); add regression\n  tests sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt and\n  ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt, and backport the\n  sapi/fpm/tests/logtool.inc helper update they need\n- CVE-2026-91767: fix out-of-bounds read in php_openssl_matches_wildcard_name()\n  where the memchr() length underflowed when the wildcard prefix and suffix\n  overlapped in the subject name, in ext/openssl/xp_ssl.c\n  (GHSA-xr7j-rvgx-xq5p); add regression test\n  ext/openssl/tests/GHSA-xr7j-rvgx-xq5p.phpt\n- CVE-2026-92842: fix out-of-bounds read in the base64-encode,\n  quoted-printable-encode and quoted-printable-decode stream filters by using\n  pestrndup() instead of the strlen-based pestrdup() for a line-break-chars\n  value containing NUL, in ext/standard/filters.c (GHSA-88hq-2827-7pg6); add\n  regression test ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt\n- CVE-2026-93682: fix out-of-bounds read on an empty Location response header\n  by using location_len instead of strlen() and skipping the relative-redirect\n  join when location_len is 0, in ext/standard/http_fopen_wrapper.c; add\n  regression tests ext/standard/tests/http/http_empty_location_redirect.phpt\n  and http_single_char_location_redirect.phpt\n- CVE-2025-1218: fix the mysqlnd wire-protocol packet over-reads by bounding\n  every length-encoded integer read against the bytes left in the packet, in\n  ext/mysqlnd/mysqlnd_wireprotocol.c, mysqlnd_wireprotocol.h,\n  mysqlnd_ps_codec.c and mysqlnd_ps.c (GHSA-r6x9-5r99-36j7), and backport the\n  prerequisite auth_protocol over-read fix that bounds the greeting packet's\n  plugin-name NUL scan; add the 38 regression tests\n  ext/mysqli/tests/ghsa-r6x9-5r99-36j7-*.phpt and the\n  ext/mysqli/tests/fake_server.inc helpers they need","modified":"2026-10-26T09:43:47.472454880Z","published":"2026-10-13T14:12:04Z","upstream":["CVE-2025-1218","CVE-2026-91767","CVE-2026-91768","CVE-2026-92842","CVE-2026-93682"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791900710.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682"}],"affected":[{"package":{"name":"php","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-bcmath","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-bcmath?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-cli","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-cli?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-common","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-common?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-dba","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-dba?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-dbg","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-dbg?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-embedded","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-embedded?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-enchant","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-enchant?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-ffi","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-ffi?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-fpm","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-fpm?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-gd","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-gd?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-gmp","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-gmp?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-intl","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-intl?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-ldap","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-ldap?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-mbstring","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-mbstring?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-mysqlnd","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-mysqlnd?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-odbc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-odbc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-opcache","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-opcache?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-pdo","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-pdo?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-pgsql","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-pgsql?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-process","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-process?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-snmp","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-snmp?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-soap","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-soap?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}},{"package":{"name":"php-xml","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/php-xml?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.30-1.el9_2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"}}],"schema_version":"1.9.0"}