CVE-2016-7398

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-7398
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7398.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-7398
Downstream
Published
2019-09-06T19:15:11.387Z
Modified
2025-11-14T04:49:21.164676Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A type confusion vulnerability in the mergeparam() function of phphttp_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

References

Affected packages

Git / github.com/m6w6/ext-http

Affected ranges

Type
GIT
Repo
https://github.com/m6w6/ext-http
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
17137d4ab1ce81a2cee0fae842340a344ef3da83

Affected versions

Other

RELEASE_2_0_1
RELEASE_2_0_2
RELEASE_2_0_3
RELEASE_2_0_4
RELEASE_2_0_5
RELEASE_2_0_6
RELEASE_2_0_7
RELEASE_2_1_0
RELEASE_2_1_0_RC1
RELEASE_2_1_0_RC2
RELEASE_2_1_0_RC3
RELEASE_2_1_1
RELEASE_2_1_2
RELEASE_2_1_3
RELEASE_2_1_4
RELEASE_2_2_0
RELEASE_2_2_0_RC1
RELEASE_2_2_1
RELEASE_2_3_0
RELEASE_2_3_0_RC1
RELEASE_2_3_1
RELEASE_2_3_2
RELEASE_2_4_0
RELEASE_2_4_1
RELEASE_2_4_2
RELEASE_2_4_3
RELEASE_2_5_0
RELEASE_2_5_0_RC1
RELEASE_2_5_1
RELEASE_2_5_2
RELEASE_2_5_3
RELEASE_2_5_5
RELEASE_2_5_6
RELEASE_2_6_0_BETA1
RELEASE_2_6_0_BETA2

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/m6w6/ext-http/commit/17137d4ab1ce81a2cee0fae842340a344ef3da83",
        "signature_type": "Line",
        "id": "CVE-2016-7398-1d33e960",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "131021496443385898743292904032294007741",
                "91232038910744409217388444223265266793",
                "261318667876175873601489787703585171531",
                "167123906585228430315616853570800366652"
            ]
        },
        "target": {
            "file": "src/php_http_params.c"
        },
        "deprecated": false
    }
]