CVE-2016-9138

Critical

Published: 04/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.

Risk Assessment

Attackers may exploit this vulnerability to disrupt PHP application functionality, potentially leading to service downtime and financial losses for the organization.

Recommendation

It is recommended to upgrade PHP to the latest version to mitigate this vulnerability and to monitor applications for suspicious activities related to serialized data processing.

Original NVD description (English source)

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup.