CVE-2015-4024: PHP multipart form parsing CPU exhaustion denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityUnauthenticated remote denial of service with high EPSS but only partial availability impact and no confirmed active exploitation or KEV listing.

What it is

PHP's multipart_buffer_headers function in main/rfc1867.c has an algorithmic complexity flaw that causes improper order-of-growth behavior when parsing crafted multipart form data. A remote attacker can send specially crafted form data to drive excessive CPU consumption. The issue affects PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9.

Impact

An unauthenticated remote attacker can exhaust CPU resources on the PHP process, degrading or denying service to legitimate users. The CVSS v2 vector shows partial availability impact only, with no confidentiality or integrity impact.

Attack surface

Reachable over the network via HTTP by submitting crafted multipart form data to any PHP endpoint that processes multipart uploads. No authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.50129, 98.85th percentile) and a reference is tagged Exploit, but the record does not confirm active exploitation.

What to do

• Upgrade PHP to 5.4.41, 5.5.25, 5.6.9 or later, or apply the vendor patch referenced in the PHP changelog.
• Apply distribution vendor updates for Red Hat, Debian, Fedora, openSUSE, Apple, HP and Oracle products listed in the references.
• Limit or rate-limit multipart form uploads at the reverse proxy or web server layer.
• Set request body size and timeout limits to bound CPU spent parsing multipart data.
• Monitor PHP worker CPU usage for anomalies tied to upload endpoints.

Detection

• Alert on sustained high CPU usage in PHP-FPM or Apache mod_php workers correlated with multipart POST requests.
• Inspect web logs for repeated multipart/form-data POSTs with unusually large or malformed header sections.
• Baseline normal multipart upload sizes and flag outliers that coincide with latency spikes.
• Track PHP error and slow-request logs for timeouts during form parsing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.