CVE-2017-11142: PHP

High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days.

In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.

Affected products

• PHP PHP: up to and including 5.6.30; version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; …

Published 2017-07-10. Last modified 2026-06-17.