[CLSA-2026:1793710895] Fix of 27 CVEs

Type:

security

Severity:

Important

Release date:

2026-11-03 13:02:00 UTC

Description:

   * ALTPHP-2638: Update to 8.23.0, a security release: fixes CVE-2026-92392
     (High, HTTP/2 upload use-after-free on a server RST_STREAM) plus
     CVE-2026-86410 CVE-2026-86412 CVE-2026-86413 CVE-2026-86414 CVE-2026-86415
     CVE-2026-87861 CVE-2026-87862 CVE-2026-87863 CVE-2026-87865 CVE-2026-92386
     CVE-2026-92387 CVE-2026-92388 CVE-2026-92389 CVE-2026-92390 CVE-2026-92391
     CVE-2026-94265 CVE-2026-94266 CVE-2026-107929 (all Low). CVE-2026-87866
     (wolfSSL) and CVE-2026-107928 (GnuTLS) do not apply to this OpenSSL build.
   * ALTPHP-2638: rebase the nscd hosts-cache patch onto 8.23.0 (context only)
   * ALTPHP-2638: skip upstream test 2095 (new in 8.23.0): it fails only in a
     full-suite run, with OpenSSL 1.1.1 and 3 alike, and passes on its own

CVEs fixed:

Updated packages:

alt-curlssl_8.23.0-1_amd64.deb
sha:22921f211966e7e4dfd7d5e1815c4758d7bad4ff
alt-libcurlssl_8.23.0-1_amd64.deb
sha:ca36d9f254412eb8aa094e2caf5ecd475c0d9fcc
alt-libcurlssl-dev_8.23.0-1_amd64.deb
sha:ca6ad3104e29e94eb2d436d5ea42bcb1c72625c4
alt-libcurlssl-doc_8.23.0-1_all.deb
sha:473443b5048abc142d9e06c0def240e4b64b4ede

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.