{"cves":["CVE-2026-109618","CVE-2026-109619","CVE-2026-91765"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[8.0.30-8.1]\n- Fix FILTER_SANITIZE_ENCODED does not encode 0xFF\n- Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison\n  CVE-2026-91768\n- Fix Various packet overreads in mysqlnd wire protocol\n  CVE-2025-1218\n- Fix TLS hostname verification falls back to CN after SAN mismatch\n  CVE-2026-91769\n- Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN\n  CVE-2026-91767\n- Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection\n  CVE-2026-6103\n- Fix Unbounded recursion in server-side cleanup_xml_node()\n  CVE-2026-91765\n- Fix Integer overflow to buffer overflow in SOAP HTTP parsing\n  CVE-2025-14181\n- Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL\n  CVE-2026-92842\n- Fix Cross-origin credential leak in HTTP stream wrapper redirects\n  CVE-2026-91766\n- Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header\n  CVE-2026-93682\n- Avoid state corruption via bailout\n  CVE-2026-109618, CVE-2026-109619","id":"ELSA-2026-87151","ovalId":"oval:com.oracle.elsa:def:202687151","source":"oracle_linux","title":"ELSA-2026-87151:  php security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-87151.html"}