CVE-2009-4017: Apple Mac OS X

Medium severity, CVSS 5.0. EPSS: 12% chance of exploitation in the next 30 days.

PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.

Affected products

• Apple Mac OS X: version 10.6.3 only
• Debian Debian Linux: version 4.0 only; version 5.0 only; version 6.0 only
• PHP PHP: before 5.2.12 (fixed in 5.2.12); version 5.3.0 only

Published 2009-11-24. Last modified 2026-06-16.