CVE-2016-7398

Name of the Vulnerable Software and Affected Versions pecl-http extension versions 3.1.0beta2 and earlier (PHP 7) pecl-http extension versions 2.6.0beta2 and earlier (PHP 5)

Description A type confusion issue in the merge param() function of php http params.c allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

Recommendations For pecl-http extension versions 3.1.0beta2 and earlier (PHP 7), update to a version that fixes the issue in the merge param() function. For pecl-http extension versions 2.6.0beta2 and earlier (PHP 5), update to a version that fixes the issue in the merge param() function. As a temporary workaround, consider restricting access to the merge param() function until a patch is available.