site/data/upstream.json (892B)
1 {
2 "schema": 1,
3 "updated": "2026-10-23",
4 "released": "2026-10-21",
5 "cves": [
6 {
7 "id": "CVE-2026-109618",
8 "ghsa": "GHSA-w8hw-w9fx-j79w",
9 "title": "OOM handling leaves request memory corrupted",
10 "cvss4": 9.2,
11 "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
12 },
13 {
14 "id": "CVE-2026-109619",
15 "ghsa": "GHSA-6wmf-4rv5-p3rp",
16 "title": "Freed global state reused (use-after-free)",
17 "cvss4": 9.2,
18 "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
19 }
20 ],
21 "fixed": {
22 "8.2": "8.2.35",
23 "8.3": "8.3.36",
24 "8.4": "8.4.27",
25 "8.5": "8.5.12"
26 },
27 "eol": {
28 "8.2": "2026-12-31"
29 },
30 "backport_branches": {
31 "7.4": "PHP-7.4-CVE-2026-109618-109619",
32 "8.0": "PHP-8.0-CVE-2026-109618-109619",
33 "8.1": "PHP-8.1-CVE-2026-109618-109619"
34 }
35 }