logoalt Hacker News

bananamogul • today at 4:55 PM • 1 reply • view on HN

Interestingly, PHP lists it as a 9.2 but RHEL lists it as an 8.1.

https://access.redhat.com/security/cve/cve-2026-109618 https://access.redhat.com/security/cve/cve-2026-109619

Is this because RedHat's default configuration isn't as vulnerable?

I'm ignorant of how these numbers are calculated. Could PHP on Debian, Ubuntu, etc. be a 9.2 but on RedHat it's only an 8.1 because RedHat has various mitigations?

Replies

chasil • today at 6:22 PM

For 109619, "Exploitation requires hitting a precise out-of-memory condition during request processing, which keeps this below Critical."

The lower criticality may be wishful thinking.