PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5873 PHP CVE debrief

CVE-2016-5873 is a critical memory-corruption issue in the pecl_http HTTP URL parsing functions. A remote attacker can trigger a buffer overflow by supplying crafted URLs containing non-printable characters, which can lead to arbitrary code execution on affected systems.

Vendor
PHP
Product
Pecl HTTP
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Organizations that use the pecl_http PHP extension, especially internet-facing applications or services that accept and parse user-controlled URLs. Security teams responsible for PHP package inventories, Linux distro packages, and embedded application stacks should treat this as a high-priority upgrade item.

Technical summary

The vulnerability is a CWE-119 buffer overflow in pecl_http’s URL parsing logic. NVD rates it CVSS 3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a remotely reachable issue with no privileges or user interaction required. The supplied description says the flaw can be triggered with non-printable characters in a URL, and the vendor references point to a fix released in pecl_http 3.0.1.

Defensive priority

Immediate. This is a remotely exploitable critical issue with full CIA impact in NVD scoring, so affected deployments should be upgraded or otherwise remediated as soon as possible.

Recommended defensive actions

  • Upgrade pecl_http to 3.0.1 or later.
  • Inventory servers and applications that include the pecl_http extension, including packaged and bundled deployments.
  • Apply the vendor or distribution update path that delivers the fixed release, and verify the installed version after patching.
  • If you cannot upgrade immediately, disable or remove the extension from exposed systems until remediation is complete.
  • Validate that security scans and package management processes check for pecl_http specifically, not only the PHP runtime.

Evidence notes

The CVE description states that pecl_http before 3.0.1 contains a buffer overflow in HTTP URL parsing functions that may allow arbitrary code execution via non-printable characters in a URL. The NVD record assigns CVSS 3.0 9.8 and CWE-119, and lists pecl_http versions up to 3.0.1 in the vulnerable CPE criteria. The supplied references include upstream patch material and the pecl_http 3.0.1 release notes, which support 3.0.1 as the remediation release.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5873 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5873

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5873 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5873

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.