Skip to content

Release Notes 1.17.6

CEP 1.17.6 fixes two critical PHP runtime vulnerabilities and a high-severity denial-of-service vulnerability in CEP's HTTP request handling.

Security Advisory

This release addresses CVE-2026-108082, which affects all CEP versions before 1.17.6. A crafted HTTP Cache-Control header can trigger excessive CPU use without authentication. Updating to CEP 1.17.6 is strongly recommended.

CEP 1.17.6 also addresses two PHP security advisories rated Critical by PHP: CVE-2026-109618 and CVE-2026-109619. They describe potential remote code execution through OOM corruption and stale global state, respectively. Updating is strongly recommended.

Resolved Issues

Issues

  • Fixed CVE-2026-108082 in CEP's HTTP request handling.
  • Updated the PHP runtime with fixes for CVE-2026-109618 and CVE-2026-109619.
  • Fixed the login form not reappearing after selecting Back when the registration page was opened directly at /login/register.