php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

CVE-2026-98876 host1x: bus: Fix missing ops null check in error teardown

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

CVE-2026-98876

The Linux kernel contains a vulnerability in the host1x_device_init() function where error teardown paths fail to verify if client->ops is non-null before dereferencing it. This oversight, absent in the forward init paths, can lead to a NULL pointer dereference if the pointer is null. The issu...

CVE-2026-98876 host1x: bus: Fix missing ops null check in error teardown

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

EUVD-2026-108722

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

Important: Red Hat Security Advisory: php security update

An update for php is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

Important: Red Hat Security Advisory: php:7.4 security update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2026-89317

gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty crit should have been...

CVE-2026-89319

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

CVE-2026-89313

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of...

CVE-2026-89319

The JweDirectDecryptorBlock.Decrypt function is vulnerable to a flaw where it reads a 64-bit plaintext length from the _thales_aad protected-header field without performing any validation. This lack of input validation leads to three distinct failure states: a truncated field causes a binary.BigE...

EUVD-2026-108652

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with...

CVE-2026-89319

"JweDirectDecryptorBlock.Decrypt" read a 64-bit plaintext length from the "thalesaad" protected-header field and used it without any validation. A truncated field panics "binary.BigEndian.Uint64", an oversized value drives an unbounded allocation, and a value larger than the decrypted block panic...

CVE-2026-89317

gose parsed the JWS "crit" header into "JwsHeader.Crit" and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty "crit" should have bee...

EUVD-2026-108633

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of...

Pillow: Reachable Undefined Behavior In Native Integer Operations, Potentially Leading To Denial Of Service Or Logic Int

Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: for xsize = 0; text; text++ int dx =...

Important: Red Hat Security Advisory: php:7.4 security update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Chromium CVE-2026-113239: Range error

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...