Vulnerability record · CVE-2012-2336 · published 11 May 2012
CVE-2012-2336: PHP CGI query string parsing flaw enables denial of service
Php · Php
PHP versions before 5.3.13 and 5.4.x before 5.4.3, when running as a CGI script (php-cgi), fail to properly handle query strings that lack an equals sign. This is an incomplete fix for CVE-2012-1823, allowing command-line options to be injected via the query string and causing resource consumption.
Description
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityAlthough CVSS 2.0 rates it medium (5.0), the high EPSS percentile and the fact it is a bypass of a previously exploited flaw raise the practical risk.
What it is
PHP versions before 5.3.13 and 5.4.x before 5.4.3, when running as a CGI script (php-cgi), fail to properly handle query strings that lack an equals sign. This is an incomplete fix for CVE-2012-1823, allowing command-line options to be injected via the query string and causing resource consumption.
Impact
A remote attacker can cause a denial of service through resource consumption on the affected PHP CGI process. There is no confidentiality or integrity impact per the CVSS vector.
Attack surface
Reachable over the network via HTTP requests to a php-cgi endpoint; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.
Exploitation
Not listed in CISA KEV, but EPSS probability is 0.50337 (98.855th percentile), indicating a high likelihood of exploitation activity; references are vendor advisories and patches with no public exploit tags.
What to do
- Upgrade PHP to 5.3.13 or 5.4.3 or later, which contain the complete fix.
- If php-cgi cannot be patched immediately, disable or restrict CGI mode and use an alternative SAPI such as php-fpm.
- Apply the vendor patch referenced in the PHP bug tracker for CVE-2012-1823/CVE-2012-2336.
- Enforce web server rules that reject or sanitize query strings lacking an equals sign before they reach php-cgi.
- Monitor and rate-limit requests to php-cgi endpoints to reduce resource exhaustion impact.
Detection
- Inspect web server and php-cgi logs for query strings that do not contain an equals sign, especially those containing command-line option patterns.
- Alert on abnormal resource consumption or process spawning tied to php-cgi requests.
- Correlate requests to php-cgi with known CVE-2012-1823 exploitation attempts and the incomplete-fix bypass pattern.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-2336 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-2336), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
