Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

PHP allows remote attacker to crash server via crafted XML

CVE-2016-9935 · published 9 years ago
Summary

Web sites running PHP versions before 5.6.29 or 7.0.14 can be sent a specially crafted XML packet that triggers a memory error, causing the server to stop responding. This could be used by an outsider to make the site unavailable. Upgrade PHP to the latest version or apply the security patches provided by the PHP project.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php php <= 5.6.28
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.0.10
3 more version ranges
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Original advisory text
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or p...
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published4 Jan 2017
Updated17 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-9935 · NVD
Track software like this
Free during beta