[El-errata] ELSA-2026-87151 Important: Oracle Linux 9 php security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-87151

http://linux.oracle.com/errata/ELSA-2026-87151.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
php-8.0.30-8.el9_8.1.x86_64.rpm
php-bcmath-8.0.30-8.el9_8.1.x86_64.rpm
php-cli-8.0.30-8.el9_8.1.x86_64.rpm
php-common-8.0.30-8.el9_8.1.x86_64.rpm
php-dba-8.0.30-8.el9_8.1.x86_64.rpm
php-dbg-8.0.30-8.el9_8.1.x86_64.rpm
php-devel-8.0.30-8.el9_8.1.x86_64.rpm
php-embedded-8.0.30-8.el9_8.1.x86_64.rpm
php-enchant-8.0.30-8.el9_8.1.x86_64.rpm
php-ffi-8.0.30-8.el9_8.1.x86_64.rpm
php-fpm-8.0.30-8.el9_8.1.x86_64.rpm
php-gd-8.0.30-8.el9_8.1.x86_64.rpm
php-gmp-8.0.30-8.el9_8.1.x86_64.rpm
php-intl-8.0.30-8.el9_8.1.x86_64.rpm
php-ldap-8.0.30-8.el9_8.1.x86_64.rpm
php-mbstring-8.0.30-8.el9_8.1.x86_64.rpm
php-mysqlnd-8.0.30-8.el9_8.1.x86_64.rpm
php-odbc-8.0.30-8.el9_8.1.x86_64.rpm
php-opcache-8.0.30-8.el9_8.1.x86_64.rpm
php-pdo-8.0.30-8.el9_8.1.x86_64.rpm
php-pgsql-8.0.30-8.el9_8.1.x86_64.rpm
php-process-8.0.30-8.el9_8.1.x86_64.rpm
php-snmp-8.0.30-8.el9_8.1.x86_64.rpm
php-soap-8.0.30-8.el9_8.1.x86_64.rpm
php-xml-8.0.30-8.el9_8.1.x86_64.rpm

aarch64:
php-8.0.30-8.el9_8.1.aarch64.rpm
php-bcmath-8.0.30-8.el9_8.1.aarch64.rpm
php-cli-8.0.30-8.el9_8.1.aarch64.rpm
php-common-8.0.30-8.el9_8.1.aarch64.rpm
php-dba-8.0.30-8.el9_8.1.aarch64.rpm
php-dbg-8.0.30-8.el9_8.1.aarch64.rpm
php-devel-8.0.30-8.el9_8.1.aarch64.rpm
php-embedded-8.0.30-8.el9_8.1.aarch64.rpm
php-enchant-8.0.30-8.el9_8.1.aarch64.rpm
php-ffi-8.0.30-8.el9_8.1.aarch64.rpm
php-fpm-8.0.30-8.el9_8.1.aarch64.rpm
php-gd-8.0.30-8.el9_8.1.aarch64.rpm
php-gmp-8.0.30-8.el9_8.1.aarch64.rpm
php-intl-8.0.30-8.el9_8.1.aarch64.rpm
php-ldap-8.0.30-8.el9_8.1.aarch64.rpm
php-mbstring-8.0.30-8.el9_8.1.aarch64.rpm
php-mysqlnd-8.0.30-8.el9_8.1.aarch64.rpm
php-odbc-8.0.30-8.el9_8.1.aarch64.rpm
php-opcache-8.0.30-8.el9_8.1.aarch64.rpm
php-pdo-8.0.30-8.el9_8.1.aarch64.rpm
php-pgsql-8.0.30-8.el9_8.1.aarch64.rpm
php-process-8.0.30-8.el9_8.1.aarch64.rpm
php-snmp-8.0.30-8.el9_8.1.aarch64.rpm
php-soap-8.0.30-8.el9_8.1.aarch64.rpm
php-xml-8.0.30-8.el9_8.1.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/php-8.0.30-8.el9_8.1.src.rpm

Related CVEs:

CVE-2026-91765
CVE-2026-109618
CVE-2026-109619




Description of changes:

[8.0.30-8.1]
- Fix FILTER_SANITIZE_ENCODED does not encode 0xFF
- Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison
  CVE-2026-91768
- Fix Various packet overreads in mysqlnd wire protocol
  CVE-2025-1218
- Fix TLS hostname verification falls back to CN after SAN mismatch
  CVE-2026-91769
- Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN
  CVE-2026-91767
- Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection
  CVE-2026-6103
- Fix Unbounded recursion in server-side cleanup_xml_node()
  CVE-2026-91765
- Fix Integer overflow to buffer overflow in SOAP HTTP parsing
  CVE-2025-14181
- Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL
  CVE-2026-92842
- Fix Cross-origin credential leak in HTTP stream wrapper redirects
  CVE-2026-91766
- Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
  CVE-2026-93682
- Avoid state corruption via bailout
  CVE-2026-109618, CVE-2026-109619