CLSA-2026-1791900710

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1791900710
Upstream
CVE (5)
  • CVE-2025-1218
  • CVE-2026-91767
  • CVE-2026-91768
  • CVE-2026-92842
  • CVE-2026-93682
Published
2026-10-13T14:12:04Z
Modified
2026-10-26T09:43:47Z
Summary
php: Fix of 5 CVEs
Details
  • CVE-2026-91768: fix FastCGI allowed_clients comparing only the first 96 bits of an IPv6 address in main/fastcgi.c (GHSA-62xp-839h-2637); add regression tests sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt and ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt, and backport the sapi/fpm/tests/logtool.inc helper update they need
  • CVE-2026-91767: fix out-of-bounds read in php_openssl_matches_wildcard_name() where the memchr() length underflowed when the wildcard prefix and suffix overlapped in the subject name, in ext/openssl/xp_ssl.c (GHSA-xr7j-rvgx-xq5p); add regression test ext/openssl/tests/GHSA-xr7j-rvgx-xq5p.phpt
  • CVE-2026-92842: fix out-of-bounds read in the base64-encode, quoted-printable-encode and quoted-printable-decode stream filters by using pestrndup() instead of the strlen-based pestrdup() for a line-break-chars value containing NUL, in ext/standard/filters.c (GHSA-88hq-2827-7pg6); add regression test ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt
  • CVE-2026-93682: fix out-of-bounds read on an empty Location response header by using location_len instead of strlen() and skipping the relative-redirect join when location_len is 0, in ext/standard/http_fopen_wrapper.c; add regression tests ext/standard/tests/http/http_empty_location_redirect.phpt and http_single_char_location_redirect.phpt
  • CVE-2025-1218: fix the mysqlnd wire-protocol packet over-reads by bounding every length-encoded integer read against the bytes left in the packet, in ext/mysqlnd/mysqlnd_wireprotocol.c, mysqlnd_wireprotocol.h, mysqlnd_ps_codec.c and mysqlnd_ps.c (GHSA-r6x9-5r99-36j7), and backport the prerequisite auth_protocol over-read fix that bounds the greeting packet's plugin-name NUL scan; add the 38 regression tests ext/mysqli/tests/ghsa-r6x9-5r99-36j7-*.phpt and the ext/mysqli/tests/fake_server.inc helpers they need
References

Affected packages

TuxCare:AlmaLinux:9.2
php

Package

Name
php
Purl
pkg:rpm/tuxcare/php?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-bcmath

Package

Name
php-bcmath
Purl
pkg:rpm/tuxcare/php-bcmath?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-cli

Package

Name
php-cli
Purl
pkg:rpm/tuxcare/php-cli?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-common

Package

Name
php-common
Purl
pkg:rpm/tuxcare/php-common?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-dba

Package

Name
php-dba
Purl
pkg:rpm/tuxcare/php-dba?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-dbg

Package

Name
php-dbg
Purl
pkg:rpm/tuxcare/php-dbg?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-devel

Package

Name
php-devel
Purl
pkg:rpm/tuxcare/php-devel?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-embedded

Package

Name
php-embedded
Purl
pkg:rpm/tuxcare/php-embedded?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-enchant

Package

Name
php-enchant
Purl
pkg:rpm/tuxcare/php-enchant?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-ffi

Package

Name
php-ffi
Purl
pkg:rpm/tuxcare/php-ffi?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-fpm

Package

Name
php-fpm
Purl
pkg:rpm/tuxcare/php-fpm?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-gd

Package

Name
php-gd
Purl
pkg:rpm/tuxcare/php-gd?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-gmp

Package

Name
php-gmp
Purl
pkg:rpm/tuxcare/php-gmp?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-intl

Package

Name
php-intl
Purl
pkg:rpm/tuxcare/php-intl?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-ldap

Package

Name
php-ldap
Purl
pkg:rpm/tuxcare/php-ldap?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-mbstring

Package

Name
php-mbstring
Purl
pkg:rpm/tuxcare/php-mbstring?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-mysqlnd

Package

Name
php-mysqlnd
Purl
pkg:rpm/tuxcare/php-mysqlnd?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-odbc

Package

Name
php-odbc
Purl
pkg:rpm/tuxcare/php-odbc?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-opcache

Package

Name
php-opcache
Purl
pkg:rpm/tuxcare/php-opcache?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-pdo

Package

Name
php-pdo
Purl
pkg:rpm/tuxcare/php-pdo?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-pgsql

Package

Name
php-pgsql
Purl
pkg:rpm/tuxcare/php-pgsql?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-process

Package

Name
php-process
Purl
pkg:rpm/tuxcare/php-process?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-snmp

Package

Name
php-snmp
Purl
pkg:rpm/tuxcare/php-snmp?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-soap

Package

Name
php-soap
Purl
pkg:rpm/tuxcare/php-soap?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"
php-xml

Package

Name
php-xml
Purl
pkg:rpm/tuxcare/php-xml?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.30-1.el9_2.tuxcare.els19

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791900710.json"