CVE-2018-19935: Debian Linux

High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days.

ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• PHP PHP: from 5.6.0, before 5.6.39 (fixed in 5.6.39); from 7.0.0, before 7.0.33 (fixed in 7.0.33); from 7.1.0, before 7.1.26 (fixed in 7.1.26); from 7.2.0, before 7.2.14 (fixed in 7.2.14)

Published 2018-12-07. Last modified 2026-06-17.