Fedora Security Advisories

docker-buildx-0.36.0-1.fc45

Fedora Security Advisories
5 days 9 hours ago
FEDORA-2026-c37317fdde Packages in this update:
  • docker-buildx-0.36.0-1.fc45
Update description:

Automatic update for docker-buildx-0.36.0-1.fc45.

Changelog * Wed Jul 29 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 0.36.0-1 - Update to release v0.36.0 - Resolves: rhbz#2506339 - Upstream new features and fixes - Resolves CVE-2026-53492 - rhbz#2496553 - Resolves CVE-2026-47262 - rhbz#2496436

isns-utils-0.103-8.fc45

Fedora Security Advisories
5 days 10 hours ago
FEDORA-2026-c1c3dda3cd Packages in this update:
  • isns-utils-0.103-8.fc45
Update description:

Automatic update for isns-utils-0.103-8.fc45.

Changelog * Wed Jul 29 2026 Chris Leech <cleech@redhat.com> - 0.103-8 - CVE-2026-55995: Denial of Service via double-free in iSNS attribute decoder (rhbz#2508456)

iscsi-initiator-utils-6.2.1.12-1.fc45

Fedora Security Advisories
5 days 10 hours ago
FEDORA-2026-004b11bc1e Packages in this update:
  • iscsi-initiator-utils-6.2.1.12-1.fc45
Update description:

Automatic update for iscsi-initiator-utils-6.2.1.12-1.fc45.

Changelog * Wed Jul 29 2026 Chris Leech <cleech@redhat.com> - 6.2.1.12-1 - rebase to Open-iSCSI 2.1.12 - CVE-2026-44943: Privilege Escalation via Path Traversal (rhbz#2508458) - CVE-2026-44944: Authentication bypass in iscsiuio control socket (rhbz#2508457)

goss-0.4.10-1.fc45

Fedora Security Advisories
5 days 10 hours ago
FEDORA-2026-68c59bf226 Packages in this update:
  • goss-0.4.10-1.fc45
Update description:

Automatic update for goss-0.4.10-1.fc45.

Changelog * Wed Jul 29 2026 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 0.4.10-1 - Update to 0.4.10 (rhbz#2494364,rhbz#2494459,rhbz#2494611,rhbz#2494911,rhbz#2495296)

php-8.4.24-1.fc43

Fedora Security Advisories
6 days 3 hours ago
FEDORA-2026-d755ca77c4 Packages in this update:
  • php-8.4.24-1.fc43
Update description:

PHP version 8.4.24 (30 Jul 2026)

BCMath:

Calendar:

  • Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year). (arshidkv12)

Date:

  • Update timelib to 2022.17. (Derick)
  • Fixed bug GH-19803 (Parsing a string with a single white space does create an error). (Derick)
  • Fixed Unix timestamps in February of the year 0 are misparsed with @-notation. (LukasGelbmann)
  • Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes). (Derick)

DBA:

  • Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

DOM:

  • Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument). (iliaal)

Exif:

  • Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)

Hash:

  • Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment). (iliaal)

Intl:

  • Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized. (Weilin Du)
  • Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice. (Weilin Du)
  • Fixed IntlChar methods leaving stale global error state after successful calls. (Xuyang Zhang)

ODBC:

  • Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)

OpenSSL:

  • Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper. (ilutov)

PDO_ODBC:

  • Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials). (iliaal)
  • Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)
  • Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen). (iliaal)
  • Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer). (iliaal)

PGSQL:

  • Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543) (ilutov)

Phar:

  • Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction. (Weilin Du)
  • Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260) (Jakub Zelenka)

PHPDBG:

  • Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
  • Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. (jorgsowa)
  • Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path. (jorgsowa)

Reflection:

  • Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()). (jorgsowa)
  • Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property). (iliaal)
  • Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output). (DanielEScherzer)
  • Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes). (DanielEScherzer)

Session:

  • Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5). (jorgsowa)

SPL:

  • Fix class_parents for classes with leading slash in non-autoload mode. (jorgsowa)
  • Ignore leading back-slash in class_parents(), class_implements(), and class_uses(). (jorgsowa)
  • Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults). (iliaal)

Standard:

  • Fixed bug GH-22360 (convert.base64-encode corruption on incremental flush). (David Carlier)
  • Fixed bug GH-22395 (base_convert() outputs at most 64 characters). (Weilin Du)
  • Fixed integer overflow in getimagesize() and getimagesizefromstring() when parsing an IFF chunk with a size of INT_MAX. (David Carlier, Weilin Du)
  • Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted). (azchin, iliaal)

Streams:

  • Fixed bug GH-22617 (persistent stream keys truncated at null bytes, causing distinct abstract unix domain sockets to share a resource). (David Carlier)

trafficserver-10.1.4-1.fc44

Fedora Security Advisories
6 days 11 hours ago
FEDORA-2026-5bec7441bb Packages in this update:
  • trafficserver-10.1.4-1.fc44
Update description:

Update to upstream 10.1.4 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

trafficserver-10.1.4-1.fc43

Fedora Security Advisories
6 days 11 hours ago
FEDORA-2026-144d6c9bcc Packages in this update:
  • trafficserver-10.1.4-1.fc43
Update description:

Update to upstream 10.1.4 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

trafficserver-9.2.15-1.el9

Fedora Security Advisories
6 days 11 hours ago
FEDORA-EPEL-2026-943e511d48 Packages in this update:
  • trafficserver-9.2.15-1.el9
Update description:

Update to upstream 9.2.15 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

trafficserver-9.2.15-1.el8

Fedora Security Advisories
6 days 11 hours ago
FEDORA-EPEL-2026-3132170b0a Packages in this update:
  • trafficserver-9.2.15-1.el8
Update description:

Update to upstream 9.2.15 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

proftpd-1.3.8d-4.el9

Fedora Security Advisories
6 days 15 hours ago
FEDORA-EPEL-2026-daf1e2cc13 Packages in this update:
  • proftpd-1.3.8d-4.el9
Update description:

This update contains backported fixes for a number of security issues, largely relating to features that are not enabled by default such as SFTP and SQL support. The exception is the addition of mod_procfs, enabled by default, which blocks accesses to procfs filesystems and hence prevents ACL bypasses via the use of the /proc/self/root directory; note that access to /proc is normally blocked via the default use of the DefaultRoot directive anyway.

proftpd-1.3.6e-11.el8

Fedora Security Advisories
6 days 15 hours ago
FEDORA-EPEL-2026-cbb4ce3efc Packages in this update:
  • proftpd-1.3.6e-11.el8
Update description:

This update contains backported fixes for a number of security issues, largely relating to features that are not enabled by default such as SFTP and SQL support. The exception is the addition of mod_procfs, enabled by default, which blocks accesses to procfs filesystems and hence prevents ACL bypasses via the use of the /proc/self/root directory; note that access to /proc is normally blocked via the default use of the DefaultRoot directive anyway.

php-8.5.9-1.fc44

Fedora Security Advisories
6 days 19 hours ago
FEDORA-2026-6131a972fe Packages in this update:
  • php-8.5.9-1.fc44
Update description:

PHP version 8.5.9 (30 Jul 2026)

Core:

  • Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL). (iliaal)
  • Fixed bug GH-22206 (missing return in global register detection). (P3p111n0)
  • Lock unmodified readonly properties for modification after clone-with. (NickSdot)

BCMath:

Calendar:

  • Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year). (arshidkv12)

Date:

  • Update timelib to 2022.17. (Derick)
  • Fixed bug GH-19803 (Parsing a string with a single white space does create an error). (Derick)
  • Fixed Unix timestamps in February of the year 0 are misparsed with @-notation. (LukasGelbmann)
  • Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes). (Derick)

DBA:

  • Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

DOM:

  • Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument). (iliaal)
  • Fixed getElementsByClassName() item() returning the wrong element on random access. (David Carlier)

Exif:

  • Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)

Hash:

  • Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment). (iliaal)

ODBC:

  • Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)

Opcache:

  • Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls). (ptondereau, iliaal)
  • Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset). (iliaal)
  • Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait). (iliaal)

OpenSSL:

  • Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper. (ilutov)

Intl:

  • Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized. (Weilin Du)
  • Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice. (Weilin Du)
  • Fixed memory leak when calling IntlListFormatter::__construct() twice. (Weilin Du)
  • Fixed IntlChar methods leaving stale global error state after successful calls. (Xuyang Zhang)

PDO_ODBC:

  • Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials). (iliaal)
  • Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)
  • Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen). (iliaal)
  • Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer). (iliaal)

PGSQL:

  • Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543) (ilutov)

Phar:

  • Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction. (Weilin Du)
  • Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260) (Jakub Zelenka)

PHPDBG:

  • Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
  • Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. (jorgsowa)
  • Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path. (jorgsowa)

Reflection:

  • Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()). (jorgsowa)
  • Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property). (iliaal)
  • Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output). (DanielEScherzer)
  • Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions). (Khaled Alam)
  • Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes). (DanielEScherzer)

Session:

  • Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5). (jorgsowa)

SPL:

  • Fix class_parents for classes with leading slash in non-autoload mode. (jorgsowa)
  • Ignore leading back-slash in class_parents(), class_implements(), and class_uses(). (jorgsowa)
  • Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults). (iliaal)

Standard:

  • Fixed bug GH-22395 (base_convert() outputs at most 64 characters). (Weilin Du)
  • Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted). (azchin, iliaal)

URI:

  • Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts. (kocsismate)
  • Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed). (kocsismate)
  • Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo). (kocsismate)
Checked
21 minutes 56 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security