2026-10-21 20:29 UTC
Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:
The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Replies (1)
-
@slink@fosstodon.org 2026-10-21 20:36
So one option in #Vinyl_Cache is to check if you have any such requests: vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form' vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form' The first command scans the in-memory log, the second runs until interrupted on live data. If you do not see multipart/form-data requests, you can simply refuse them in VCL. #php2shell