Summary
[8.0.30-8.1]
- Fix FILTER_SANITIZE_ENCODED does not encode 0xFF
- Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison
CVE-2026-91768
- Fix Various packet overreads in mysqlnd wire protocol
CVE-2025-1218
- Fix TLS hostname verification falls back to CN after SAN mismatch
CVE-2026-91769
- Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN
CVE-2026-91767
- Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection
CVE-2026-6103
- Fix Unbounded recursion in server-side cleanup_xml_node()
CVE-2026-91765
- Fix Integer overflow to buffer overflow in SOAP HTTP parsing
CVE-2025-14181
- Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL
CVE-2026-92842
- Fix Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91766
- Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVE-2026-93682
- Avoid state corruption via bailout
CVE-2026-109618, CVE-2026-109619
Fixed packages 25
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | php | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-bcmath | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-cli | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-common | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-dba | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-dbg | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-devel | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-embedded | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-enchant | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-ffi | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-fpm | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-gd | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-gmp | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-intl | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-ldap | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-mbstring | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-mysqlnd | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-odbc | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-opcache | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-pdo | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-pgsql | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-process | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-snmp | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-soap | 0:8.0.30-8.el9_8.1 |
| Oracle Linux · 9 | php-xml | 0:8.0.30-8.el9_8.1 |
Vulnerabilities 3
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
High 7.5
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the …