CVEvulnerability

CVE-2016-7398

9.8 CRITICAL Published 2019-09-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-704

Description

A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

Affected configurations

• php ext-http (<= 2.5.6) • php ext-http (>= 3.0.0 <= 3.0.1) • php ext-http 2.6.0 • php ext-http 3.1.0

Related

Weakness · CWE (1)

  • CWE-704 Incorrect Type Conversion or Cast weakness

References