CVE-2016-5873
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote...
CVE-2016-5873 is a critical vulnerability (CVSS 9.8) in Php Pecl Http, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.70%, the 91st percentile. Fixed in php-pecl-http 3.0.1-0.1.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 4.70%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.1-0.1php-pecl-http +2 more
Description
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-pecl-httpDebian:12 | before 3.0.1-0.1 | 3.0.1-0.1 |
php-pecl-httpDebian:13 | before 3.0.1-0.1 | 3.0.1-0.1 |
php-pecl-httpDebian:14 | before 3.0.1-0.1 | 3.0.1-0.1 |
What each source reports
NVD Score used
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
- Record
CVE-2016-5873- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
- Record
CVE-2016-5873- Updated
- 2026-11-02
EUVDEUVD-2016-6807No score
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
- Record
EUVD-2016-6807- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fwhg-hgwv-c646
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote...
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
- Record
GHSA-fwhg-hgwv-c646- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
- Record
CVE-2016-5873- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-5873
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
- Record
DEBIAN-CVE-2016-5873- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.