TI-2026-78794 CVE-2026-109619
PHP remote code execution via stale global state
Priority CRITICAL 99KEV
PHP has various global state that temporarily points into request memory.
RHSA-2026:87080
php:7.4 security update
Released 2026-10-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.10.0+22485+a3539972.noarch::php:7.4, libzip-1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4, libzip-1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4 +47
Fixes 12 records
Priority CRITICAL 99KEV
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
TI-2026-63096 CVE-2026-93682
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Priority HIGH 65
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location.
Priority MEDIUM 62
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger.
Priority MEDIUM 53
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check.
Priority LOW 39
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit.
TI-2026-61979 CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Priority LOW 29
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address.
TI-2026-61978 CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Priority LOW 28
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the h…
TI-2026-62559 CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Priority LOW 26
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself.
Priority LOW 26
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a…
Priority LOW 26
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them.
Priority LOW 19
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name.