- CVE-2026-92842: convert.base64-encode and convert.quoted-printable-* stream filters duplicated line-break-chars with strlen-based pestrdup() but kept the full length, so a value containing a NUL byte caused a heap buffer over-read (GHSA-88hq-2827-7pg6) - CVE-2025-14181: ext/soap get_http_body() accumulated chunked response sizes in a signed int, so large chunk sizes wrapped and the body buffer was reallocated too small, causing a heap buffer overflow (GHSA-cj93-vc83-wgqv); sizes are now size_t and bounded by ZSTR_MAX_LEN - CVE-2026-6103: ext/phar accepted overflowing or malformed tar entry sizes and did not skip the data of every entry type that carries data, letting attacker-controlled data be parsed as a tar header and inject entries (GHSA-j3wh-g957-2m85) - CVE-2026-91765: ext/soap recursed without bound when cleaning up, searching and decoding deeply nested or self-referencing XML, allowing a stack overflow (GHSA-rgrp-mwpx-f6rm); nesting depth is now capped