Skip to content

Mitigate CVE-2026-109619 in session handling - #24775

Closed
SleepTheGod wants to merge 1 commit into
php:masterfrom
SleepTheGod:patch-2
Closed

SleepTheGod wants to merge 1 commit into
php:masterfrom
SleepTheGod:patch-2

Conversation

@SleepTheGod

Copy link
Copy Markdown

Added CVE-2026-109619 mitigations to clear stale pointers and prevent memory issues during session handling.

Added CVE-2026-109619 mitigations to clear stale pointers and prevent memory issues during session handling.

@SleepTheGod SleepTheGod left a comment

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked

@LamentXU123

Copy link
Copy Markdown
Member

Why would you open two similar PR yourself #24771

@ArtUkrainskiy

Copy link
Copy Markdown
Contributor

Checked

what checked?
master already fixes this in 3584a98 (Avoid state corruption via bailout), merged 21 Oct, which covers both CVEs. It replaces the OOM bailout with UnwindExit, so this reintroduces the approach that commit dropped. The red CI check is the rfc1867 OOM test. I think it's already handled upstream.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants