CVE-2012-2329: PHP CGI apache_request_headers buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityRemote, unauthenticated and easy to trigger, but the documented impact is limited to denial of service and the affected PHP 5.4.x line is long obsolete.

What it is

PHP 5.4.x before 5.4.3 contains a buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c. A remote attacker can trigger it with a long string in an HTTP request header, crashing the application. The flaw is a memory buffer overflow (CWE-119) with only partial impact per the CVSS 2.0 vector.

Impact

The stated impact is denial of service via application crash; the CVSS vector rates confidentiality and integrity as none and availability as partial. No code execution or data exposure is claimed in the record.

Attack surface

Reachable remotely over the network through an HTTP request header, with no authentication required (AV:N/AC:L/Au:N). No user interaction is indicated by the vector or description.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at 0.623 (99th percentile), suggesting elevated likelihood of exploitation activity. No reference is tagged as an exploit.

What to do

• Upgrade PHP to 5.4.3 or later, which the vendor changelog identifies as the fix.
• If immediate upgrade is not possible, restrict or filter oversized HTTP request headers at the reverse proxy or web server.
• Avoid running PHP in CGI mode where the vulnerable apache_request_headers path is exposed, or isolate such deployments.
• Track vendor and distribution advisories for backported patches to older PHP branches.

Detection

• Monitor web and PHP logs for crashes or abnormal process termination correlated with unusually long HTTP request headers.
• Alert on request headers exceeding normal length thresholds at the proxy or WAF layer.
• Watch for repeated malformed or oversized header requests from single sources targeting PHP CGI endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.