CVE-2016-9137

Critical

Published: 04/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability in the CURLFile implementation in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.

Risk Assessment

Organizations may be exposed to attacks that lead to denial of service, affecting application availability and data security.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for suspicious activities.

Original NVD description (English source)

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.