CVE-2011-4885: PHP form parameter hash collision denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with public exploit code and very high EPSS, though CVSS base score is only 5.0 and no KEV listing.

What it is

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker can send many crafted parameters to force excessive hash collisions. This matters because it lets an unauthenticated attacker exhaust CPU on PHP web servers.

Impact

An attacker can cause a denial of service through sustained CPU consumption, degrading or taking down the affected PHP application. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

Reached remotely over the network by submitting HTTP requests with crafted form parameters to a PHP application. No authentication or user interaction is required, per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.8337, 99.663rd percentile) and public exploit code exists in Exploit-DB (18296, 18305), indicating active exploitation is likely.

What to do

• Upgrade PHP to 5.3.9 or later, or apply the vendor patch for your distribution.
• Apply available OS vendor updates (Red Hat, Debian, openSUSE, Mandriva, Apple, HP, Oracle) that backport the fix.
• Limit request parameter counts and request body size at the web server or WAF to reduce collision payloads.
• Monitor CPU usage on PHP hosts and rate-limit or block abusive clients.

Detection

• Alert on sustained high CPU usage on PHP web servers without a matching traffic increase.
• Inspect HTTP requests for unusually large numbers of form parameters or repeated parameter names.
• Use web server logs to identify single clients sending high-volume POST requests with many parameters.
• Correlate spikes in request processing time with parameter-heavy requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.