CVE-2016-7417

Critical

Published: 17/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In PHP before 5.6.26 and 7.x before 7.0.11, there is a vulnerability in ext/spl/spl_array.c that allows SplArray unserialization without validating a return value and data type. This can lead to denial of service or possibly unspecified other impacts via crafted serialized data.

Risk Assessment

Remote attackers can exploit this vulnerability to disrupt application functionality, potentially leading to downtime or other availability issues.

Recommendation

It is recommended to upgrade PHP to version 5.6.26 or 7.0.11 and later to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.