CVE-2016-7398

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-7398
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7398.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-7398
Downstream
Published
2019-09-06T19:15:11Z
Modified
2026-05-18T12:50:14Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

References

Affected packages

Git / github.com/m6w6/ext-http

Affected ranges

Type
GIT
Repo
https://github.com/m6w6/ext-http
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
4f48201b690b6b10bffa348833364d1a3760483c
Last Affected
78b1171bc5e44396d142957532d7b3992a818d16
Last Affected
78b58967b4befb4118572312f82f63d77e102b41
Last Affected
cc9215bc026c37420de775d3ef95c582caf8eca0
Last Affected
7aae15af085c924234725d7e55a4b571fe4b9ea5
Last Affected
635a882456da2800b93bac83bbbd33404ffd0798
Last Affected
2af0b25292467a09e408d07b1fab39f9e407609a
Last Affected
9cf5671e4429610d3e82e304e16166c1c44d1566
Last Affected
9dd0b2cfed592d833ab46eca976d50e0c5696d77
Introduced
1eef7cfb325e57887432f6bba837c8e39d3e7f34
Last Affected
9d607c62df6393665a82f4997eae68345395c0fc
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:php:ext-http:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:2.6.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:2.6.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:2.6.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:2.6.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:3.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:3.1.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:3.1.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:php:ext-http:3.1.0:rc1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.6"
        },
        {
            "last_affected": "2.6.0-NA"
        },
        {
            "last_affected": "2.6.0-beta1"
        },
        {
            "last_affected": "2.6.0-beta2"
        },
        {
            "last_affected": "2.6.0-rc1"
        },
        {
            "last_affected": "3.1.0"
        },
        {
            "last_affected": "3.1.0-beta1"
        },
        {
            "last_affected": "3.1.0-beta2"
        },
        {
            "last_affected": "3.1.0-rc1"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.1"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

Other
RELEASE_2_0_1
RELEASE_2_0_2
RELEASE_2_0_3
RELEASE_2_0_4
RELEASE_2_5_0
RELEASE_2_5_0_RC1
RELEASE_2_5_1
RELEASE_2_5_2
RELEASE_2_5_3
RELEASE_2_5_5
RELEASE_2_5_6
RELEASE_2_6_0
RELEASE_2_6_0_BETA1
RELEASE_2_6_0_BETA2
RELEASE_2_6_0_RC1
RELEASE_3_0_0
RELEASE_3_0_1
RELEASE_3_1_0
RELEASE_3_1_0_BETA1
RELEASE_3_1_0_BETA2
RELEASE_3_1_0_RC1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7398.json"