- CVE-2026-92842: out-of-bounds read in the convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters when the line-break-chars option contains a NUL byte; the three constructors in ext/standard/filters.c now duplicate it with pestrndup() instead of the strlen-based pestrdup(), so the allocation matches the lbchars_len the converters copy. Adds upstream's ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt, adapted for 5.2 (array() instead of the short-array literal); %check collects and runs it, but its run-tests.php call ends in "|| true", so a failing test is reported in the build log and does not fail the build - CVE-2025-14181: integer overflow in ext/soap get_http_body() - a chunked response whose chunk sizes total more than INT_MAX wrapped the accumulator negative and overflowed the body buffer. The accumulator is size_t now, each growth step is bounded against INT_MAX before the addition is performed, and the Content-Length and Connection: close paths get the same bound. The Location: redirect allocation upstream also hardens becomes safe_emalloc(1, p - t, strlen(new_url->path) + 2). No test: the upstream one needs a live http endpoint and 4 GB of RAM - CVE-2026-6103: phar tar entry injection - entry sizes that cannot be represented (octal overflow, GNU base-256, non-octal digits, trailing garbage) are rejected by a new phar_tar_size(), GNU long link records are refused, and every entry type that carries data has its data blocks skipped. Applies to ext/phar/tar.c and ext/phar/phar_internal.h from the bundled PECL phar-2.0.0, which is unpacked before patching. Adds upstream's three ext/phar/tests/tar/GHSA-j3wh-g957-2m85-*.phpt, adapted for 5.2 (array(), dirname(__FILE__), --SKIPIF-- instead of --EXTENSIONS--); %check collects and runs them, but its run-tests.php call ends in "|| true", so a failing test is reported in the build log and does not fail the build - CVE-2026-91765: unbounded recursion in ext/soap XML parsing and decoding. cleanup_xml_node() and get_node_with_attribute_recursive_ex() are iterative now, documents nested deeper than SOAP_MAX_XML_DEPTH (2048) are rejected on libxml2 below 2.13, and the to_zval() decode chain is capped at SOAP_MAX_DECODE_DEPTH by a counter in the soap module globals, which also bounds href chains and cycles. Adds two of upstream's three ext/soap/tests/GHSA-rgrp-mwpx-f6rm*.phpt, the href-chain and href-cycle ones, adapted for 5.2. The third, the XML-depth one, is not carried: soap_xmlParseFile() on this branch never sets XML_PARSE_HUGE, so libxml2 rejects its WSDL fixtures at its own depth limit of 256, well before the 2048 cap the fix adds, and no fixture can both parse here and reach the check. %check collects and runs the two, but its run-tests.php call ends in "|| true", so a failing test is reported in the build log and does not fail the build