-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 24 Sep 2026 19:09:11 +0200
Source: php8.4
Architecture: source
Version: 8.4.26-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP Maintainers <team+pkg-php@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
php8.4 (8.4.26-1) unstable; urgency=medium
.
* New upstream version 8.4.26
+ [CVE-2026-91768]: IPv6 ACL bypass in FastCGI listen.allowed_clients
due to partial address comparison.
+ [CVE-2025-1218]: Various packet overreads in mysqlnd wire protocol.
+ [CVE-2026-91769]: TLS hostname verification falls back to CN after
SAN mismatch.
+ [CVE-2026-91767]: Heap buffer overflow in
php_openssl_matches_wildcard_name() on crafted server certificate
wildcard CN.
+ [CVE-2026-6103]: Integer overflow in phar_tar_number() allowing TAR
archive entry injection.
+ [CVE-2026-91765]: Unbounded recursion in server-side
cleanup_xml_node().
+ [CVE-2025-14181]: Integer overflow to buffer overflow in SOAP HTTP
parsing.
+ [CVE-2026-93682]: Out-of-bounds read in the HTTP stream wrapper when
following a redirect with an empty Location header.
+ [CVE-2026-92842]: Out-of-bounds read in convert.* stream filters when
line-break-chars contains NUL.
+ [CVE-2026-91766]: Cross-origin credential leak in HTTP stream wrapper
redirects.
+ [CVE-2026-17545]: Reserved device names are not rejected before file
and stream I/O.
Checksums-Sha1:
60d93f392fcd138100bb4ae67142f2a5020c0039 5661 php8.4_8.4.26-1.dsc
ebc70fb6f8f41c7a0e406fdccb5610f4de9e8309 13791528 php8.4_8.4.26.orig.tar.xz
3e50030c312ca12d1cf0ccecd407ba1d95f564b0 833 php8.4_8.4.26.orig.tar.xz.asc
5edf2e25416750d9a294e4d90a3a81664a8ecc42 80776 php8.4_8.4.26-1.debian.tar.xz
19651279fece2278e1cf74770f7e3236f5267ffb 32834 php8.4_8.4.26-1_amd64.buildinfo
Checksums-Sha256:
02553e9b42729c5c5c7b738fabf72d5997fc935f373181423b5f990fddc7359b 5661 php8.4_8.4.26-1.dsc
32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1 13791528 php8.4_8.4.26.orig.tar.xz
60e78a39e9a22abbb21b60817cd5c9591d0fe208e398207d2d2cc8d0b7892fb5 833 php8.4_8.4.26.orig.tar.xz.asc
7cab110f857918419274467abf89aa0667cf1ed7e526448cbedd062bf705a8f8 80776 php8.4_8.4.26-1.debian.tar.xz
215f4e0c5d2e3ada2550f0e1e5f08419d10a5abf64a5abac8818cb91cc3f2815 32834 php8.4_8.4.26-1_amd64.buildinfo
Files:
e965a4ad9b69c2120dbf1a63c0819dad 5661 php optional php8.4_8.4.26-1.dsc
8c9d126a31b3074d86199d16ad8a07e7 13791528 php optional php8.4_8.4.26.orig.tar.xz
afc9bb33e0c1c280ec3a4c9196d6f57d 833 php optional php8.4_8.4.26.orig.tar.xz.asc
f0a3da11d9912011d45413b8d7bd1f7a 80776 php optional php8.4_8.4.26-1.debian.tar.xz
cb75036dd984df143b404cd38b7d0935 32834 php optional php8.4_8.4.26-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmq7KNlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcJL0g/7BSztW0mEMH0JL3bGCSPmE5jmE2uFB0ZJHg3Jpc1q9+JcxkeuVWUwkPcY
dA/TsQRkESjRQAVGH5SChcC/j5Snk2UaiRHO/NvucD/A7uyMeDdm2yiOIjT9ACsk
oaajXcGOSvZgcZsYVEV8xvyMLN4QseHghaNCdTFI+VHoVnA6Q8oiA/I15YEtHi1y
PcDUSYzku/4hxw771mGzkpCGBH3+aa+OGIIM1a1gX1Fg1gxIlW1IVW9gIZjTohRt
kM2HrkSOBFoCDansuDogopYSI8LeSb0je/WbGLsSwQI/c56kGX6OEJGGk/BLg6/5
6pD+2XdO4cinPL2dVqef9bqHX4xPCIrTFbP+yl/EdZvPolh4sJwK/U6RbVNDfeBK
chzMw5L3ynErf5Sf/GnyQRyLs8ARHtgfCfHJAuZbueKwz3M+kpxxJjrN55T7k1aB
nA76/WZLUYGOFto4QUSCUi8utRhQYKe4lF4oZESwaBUwKkrgCmyl3du0icIwhY33
xTwyPVzNquINl/KT+aKKTJVFmtvdKAElfGQHUjhg2GGsSOJsmJ7T4wmJcud02RMG
Ii5PW9zLSYuqhIRiHv5EWIa69aunBjgK6W7qESbw4CaGgnPw7fWo3Dc6cCS9koGr
0Shi8Q1PLymq63Gx8xAaXYuDFGz9swcLuvnjM88sEy8iXfaTmM0=
=PQ1j
-----END PGP SIGNATURE-----
