CVE-2016-6290
CriticalSummary
In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an issue with improper maintenance of a certain hash data structure, which can lead to denial of service (use-after-free) or possibly unspecified other impacts related to session deserialization.
Risk Assessment
Remote attackers may exploit this vulnerability to disrupt application functionality, potentially leading to downtime and loss of service availability.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for unauthorized activities.
Original NVD description (English source)
ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.