coop-cloud/nextcloud
10
7
Fork 11
Code Issues 13 Pull Requests 9 Releases Wiki Activity

Mitigation for PHP CVE

Browse Source 
This includes the mitigations proposed by
https://www.php.net/archive/2026.php#2026-10-21-5
This commit is contained in:
Linus Gasser
2026-10-21 16:19:16 +02:00
parent b340a80532
commit 0e2d8484ee
3 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
abra.sh
+1 -1
View File
@@ -1,6 +1,6 @@
#!/bin/bash
export FPM_TUNE_VERSION=v5
export FPM_TUNE_VERSION=v6
export NGINX_CONF_VERSION=v9
export MY_CNF_VERSION=v6
export ENTRYPOINT_VERSION=v3
fpm-tune.ini
+9
View File
@@ -1,5 +1,14 @@
[www]
pm = dynamic
pm.max_children = {{ env "FPM_MAX_CHILDREN" }}
pm.start_servers = {{ env "FPM_START_SERVERS" }}
pm.min_spare_servers = {{ env "FPM_MIN_SPARE_SERVERS" }}
pm.max_spare_servers = {{ env "FPM_MAX_SPARE_SERVERS" }}
; Mitigations for CVE-2026-109618 / CVE-2026-109619 until the image ships
; PHP >= 8.5.12, see https://www.php.net/archive/2026.php#2026-10-21-5
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 30M
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[fatal_error_backtraces] = 0
release/next
+4
View File
@@ -0,0 +1,4 @@
Security: mitigates PHP RCE CVE-2026-109618 / CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5)
via the FPM pool config: memory_limit=-1, post_max_size=32M, upload_max_filesize=30M,
session.upload_progress.enabled=0, fatal_error_backtraces=0. PHP_MEMORY_LIMIT and PHP_UPLOAD_LIMIT
are overridden for web requests until the nextcloud image ships PHP >= 8.5.12.