- CVE-2026-92842: heap buffer over-read in the convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters - line-break-chars was copied with the strlen()-based pestrdup() while its full length was kept, so a value containing a NUL byte made the filter read past the end of the truncated copy; it is now copied with pestrndup() (backport of upstream b4e3397ec8f4f647e6e019dbf79870fc2f14ba78) - CVE-2025-14181: integer overflow in the SOAP client HTTP body reader - get_http_body() summed chunk sizes in a signed int guarded by an overflow-dependent check, so large chunk sizes could shrink the reallocation and overflow the heap buffer; the accumulator is now size_t, every growth step is bounded by ZSTR_MAX_LEN and uses zend_string_safe_realloc(), and the redirect path join uses safe_emalloc() (backport of upstream b11bd1d9390bb203684e3d4aa5e1104ea842de6f) - CVE-2026-6103: phar tar entry injection - unparsable or wrapping entry sizes and data-carrying entry types other than regular files left the parser on attacker data that was read as the next tar header; such sizes are now rejected, the data of every data-carrying type is skipped, GNU long link records are refused and over-long ././@LongLink names are rejected (backport of upstream 0994e2e887cd993866b5e4d7dba2fade5caeefec) - CVE-2026-91765: unbounded recursion in ext/soap XML parsing and decoding - deeply nested requests/WSDLs and href chains or cycles exhausted the stack; the XML tree walkers are now iterative, documents deeper than 2048 levels are rejected on libxml2 < 2.13, and decoding stops with "Encoding: Nesting level too deep" past 4096 nested values (backport of upstream 3655b79c7bfa90db004d75a3b282ed0f538f4836)