ALAS2023-2026-3164: CVEs fixed (Amazon Linux)

ALAS2023-2026-3164 fixes 6 tracked CVEs. Affected systems and fixed versions.

CVE-2026-93682 MEDIUM 5.8 UPGRADE When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value
CVE-2025-14181 MEDIUM 6.5 UPGRADE The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, wh
CVE-2025-1218 LOW 3.4 UPGRADE The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still hold
CVE-2026-91765 HIGH 7.5 UPGRADE cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
CVE-2026-91766 MEDIUM 5.9 UPGRADE When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Pro
CVE-2026-91769 MEDIUM 4.3 UPGRADE PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no

Applies to