CVE-2010-1866: Opensuse

Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days.

The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.

Affected products

• Opensuse Opensuse: version 11.1 only; version 11.2 only; version 11.3 only
• PHP PHP: from 5.3.0, up to and including 5.3.2
• Suse Linux Enterprise: version 10.0 only; version 11.0 only

Published 2010-05-07. Last modified 2026-06-16.