PHP resource management error vulnerability

Versions prior to PHP 8.2.35, versions prior to PHP 8.3.36, versions prior to PHP 8.4.27, and versions prior to PHP 8.5.12 contain a security vulnerability. This vulnerability arises when longjmp is used to handle an out-of-memory error, causing the current context to exit and terminate requests...

PHP Vulnerability: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP Vulnerability: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP Vulnerability: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP2Shell RCE vulnerabilities that can allow unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619)

The Brocade Product Security Team has become aware of two memory-safety vulnerabilities stemming from improper handling of fatal errors, specifically out-of-memory errors, during request processing in PHP. When a request terminates unexpectedly due to these errors, the internal PHP state can beco...

ALSA-2026:87071 Important: php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

ALSA-2026:87072 Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87073 Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87079 Important: php:8.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87151 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

PT-2026-120812

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

PT-2026-120702

Name of the Vulnerable Software and Affected Versions Cisco products affected versions not specified Description A memory management issue exists in the Snort 3 Detection Engine due to incomplete error checking during file processing. This flaw can lead to unreleased memory, which an...

PT-2026-120545

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra stream id for every additional stream. The response...

PT-2026-120681

Name of the Vulnerable Software and Affected Versions Snort 3 affected versions not specified Description An issue involving out-of-bounds writes occurs in the software. Out-of-bounds write is a condition where the software writes data past the end, or before the beginning, of the intended buffer...

PT-2026-129110

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self. size without rerunning Image. decompression bomb check. A tiny file can use a safe first frame to pass Image.open and then declare very...

PT-2026-120178

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm processor kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel config values...

PT-2026-122476

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Pillow resource management error vulnerability

Versions of Pillow from 11.2.1 up to but not including 13.0.0 contain a resource management error vulnerability. This vulnerability arises because Arrow assumes that image rows are tightly packed and exports them from im-blocks0.ptr. It fails to properly handle row padding or alignment offsets...

Linux Distros Unpatched Vulnerability : CVE-2026-113150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...