Vulnerability in Php

CVE-2009-4418

The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.

EPSS: 0.010 (58.3th percentile) — read the EPSS interpretation.

Affected products

  • Php — versions 5, 5.0, 5.0.0
  • N/a — versions n/a

Weakness classification (CWE)

References