-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 19:16:18 +0200
Source: php8.4
Architecture: source
Version: 8.4.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian PHP Maintainers <team+pkg-php@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
 php8.4 (8.4.26-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 8.4.26
    + [CVE-2026-91768]: IPv6 ACL bypass in FastCGI listen.allowed_clients
      due to partial address comparison.
    + [CVE-2025-1218]: Various packet overreads in mysqlnd wire protocol.
    + [CVE-2026-91769]: TLS hostname verification falls back to CN after
      SAN mismatch.
    + [CVE-2026-91767]: Heap buffer overflow in
      php_openssl_matches_wildcard_name() on crafted server certificate
      wildcard CN.
    + [CVE-2026-6103]: Integer overflow in phar_tar_number() allowing TAR
      archive entry injection.
    + [CVE-2026-91765]: Unbounded recursion in server-side
      cleanup_xml_node().
    + [CVE-2025-14181]: Integer overflow to buffer overflow in SOAP HTTP
      parsing.
    + [CVE-2026-93682]: Out-of-bounds read in the HTTP stream wrapper when
      following a redirect with an empty Location header.
    + [CVE-2026-92842]: Out-of-bounds read in convert.* stream filters when
      line-break-chars contains NUL.
    + [CVE-2026-91766]: Cross-origin credential leak in HTTP stream wrapper
      redirects.
    + [CVE-2026-17545]: Reserved device names are not rejected before file
      and stream I/O.
Checksums-Sha1:
 eba5df83e859af2b9857775d32708f0e20dd80f7 5619 php8.4_8.4.26-1~deb13u1.dsc
 ebc70fb6f8f41c7a0e406fdccb5610f4de9e8309 13791528 php8.4_8.4.26.orig.tar.xz
 3e50030c312ca12d1cf0ccecd407ba1d95f564b0 833 php8.4_8.4.26.orig.tar.xz.asc
 bc24d6043c6f2ff0a74ca28237ab46bf578b8274 75100 php8.4_8.4.26-1~deb13u1.debian.tar.xz
 9aacc3a962f0cbff24136ecb44506ef0cb73d882 34740 php8.4_8.4.26-1~deb13u1_amd64.buildinfo
Checksums-Sha256:
 f00a9877965fedd1bf1e8f471ca43125f487454c8e731b56f2c1692a2ef5bef8 5619 php8.4_8.4.26-1~deb13u1.dsc
 32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1 13791528 php8.4_8.4.26.orig.tar.xz
 60e78a39e9a22abbb21b60817cd5c9591d0fe208e398207d2d2cc8d0b7892fb5 833 php8.4_8.4.26.orig.tar.xz.asc
 0403211da38ccacfe8bcd4ddca8342d5cc3ac1aab4a9e36bec302b3dae32bfee 75100 php8.4_8.4.26-1~deb13u1.debian.tar.xz
 5ce0db6b544068a01dafd241bf7c2d1ede74c877196eb0458895f02fe3de21c6 34740 php8.4_8.4.26-1~deb13u1_amd64.buildinfo
Files:
 fbd0e15d0513fa34f7023ec536417749 5619 php optional php8.4_8.4.26-1~deb13u1.dsc
 8c9d126a31b3074d86199d16ad8a07e7 13791528 php optional php8.4_8.4.26.orig.tar.xz
 afc9bb33e0c1c280ec3a4c9196d6f57d 833 php optional php8.4_8.4.26.orig.tar.xz.asc
 c7b0864af9362dd01a980e13bbc33505 75100 php optional php8.4_8.4.26-1~deb13u1.debian.tar.xz
 8b2135f3e3a30193883468c7f629ea67 34740 php optional php8.4_8.4.26-1~deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmq1cjRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcLrDg/+JORE0elqbZVMM6CQyi60QzHs3peP8Elwy+2O9c6QKywCCcWYU1ApGPD3
hiLY1M/HAGxeWbiuq8iXd3C9r/Ys5hR736+PoONRRAWR0cQOAtPGUrva/4TJ9KUR
9iBCrcsakSxYAeg9+9ZfYmmyR1KDmZWCW/SDOGS72iZj/KEiXXOdUmv4hwrv17/O
uD0hk87V5jeCOMO3XS1C8epfMN5pCjE0E7aAh0dmnvcFITScjk2OpdxhvhF9a5OD
NUi5icP+vDWgHbjuEx9/OZ1AWsqLj7F9FuDqs04Cr/0AU1Z8RZE++4dVo2ZM8vuw
W848xhyrlwFnYVzl8vex1um94n0t1tuwKZvcPMFIpAnEjafTzpPNMmYUTYP9Qz7+
fx3m+4cD50o5vDkc+m0r0pqopGOfEZ7Xv6iKFpw0t6mynamuPH6lAN3qPLjDJ/kh
/gi2FTmNDO5wQ6V6sOfi9nBd3y1MEHAAsX1fnfcBfe7wMQj450oiFBmypfuzXdqj
wqDS7zGAqGJnZ8URXciQ1NziAEjijP21Jwqpfw6euDqdOJqLZ291PSIqdWnnhVkf
niHQIBoBZ53ewG64NxYHr9asCuTYffzF0Yn+3CAy5/giWJ+7juh7HXao/+dgx7BV
eCMXBUxf8Z77mU0iNouiPLxoPHpdWel5WaU/ouGiaGdEr46WIzw=
=juGs
-----END PGP SIGNATURE-----