Resource exhaustion in Php
CVE-2023-0568
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
EPSS: 0.013 (67.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@php.net (Exploit, Patch, Issue Tracking, Vendor Advisory)
- security@php.net
Frequently asked questions
- What is CVE-2023-0568?
- CVE-2023-0568 is a high-severity vulnerability in Php, classified under Incorrect Calculation of Buffer Size. CVSS score: 7.5/10. Published 2023-02-16.
- How severe is CVE-2023-0568?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-0568 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.