Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-93682 | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-6103 | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds val | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2025-14181 | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not g | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-91765 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP reques | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-91766 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, eve | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2025-1218 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-91767 | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-91769 | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-91768 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-92842 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose | php8.5 php8.5 php8.5 php8.5 php8.3 php8.3 php8.1 php8.1 |
| CVE | CVE-2026-78659 | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the serv | golang-1.22 golang-1.22 |
| CVE | CVE-2026-78663 | The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-b | golang-1.22 golang-1.22 |
| CVE | CVE-2026-78669 | A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small | golang-1.22 golang-1.22 |
| CVE | CVE-2026-78667 | When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amoun | golang-1.22 golang-1.22 |
| CVE | CVE-2026-94439 | When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly con | golang-1.22 golang-1.22 |
| CVE | CVE-2026-56866 | When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing afte | golang-1.22 golang-1.22 |
| CVE | CVE-2026-94440 | Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is le | golang-1.22 golang-1.22 |
| CVE | CVE-2026-78660 | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 fram | golang-1.22 golang-1.22 |
| CVE | CVE-2026-56865 | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist | golang-1.22 golang-1.22 |
| CVE | CVE-2026-33818 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | golang-1.22 golang-1.22 |
About
-
Send Feedback to @ubuntu_updates
