CVE-2018-7584: PHP HTTP stream wrapper stack buffer under-read via crafted HTTP response

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCritical CVSS and very high EPSS with public exploit material, but exploitation requires the attacker to control or influence an HTTP response consumed by PHP, which limits reach compared with a directly exposed remote flaw.

What it is

PHP versions through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2 contain a stack-based buffer under-read in php_stream_url_wrap_http_ex in ext/standard/http_fopen_wrapper.c while parsing an HTTP response. The flaw leads to copying a large string, which can crash the process or leak memory contents. It matters because PHP's HTTP stream wrapper is widely used for outbound HTTP requests, so any code path that fetches a URL can be affected.

Impact

An attacker who controls or can influence an HTTP response can trigger a memory under-read, causing a denial of service and potentially disclosing process memory. The CVSS vector rates confidentiality, integrity, and availability impact as high.

Attack surface

Reached over the network when PHP parses an HTTP response through the HTTP stream wrapper (for example fopen or file_get_contents on an http:// URL). The CVSS vector shows no privileges or user interaction required, but the attacker must be able to supply or influence the response the PHP process consumes.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.87348 (99.7th percentile) and an Exploit-DB entry is referenced, indicating public exploit material exists.

What to do

• Upgrade PHP to a fixed release: 5.6.34 or later, 7.0.28 or later, 7.1.15 or later, or 7.2.3 or later.
• Apply vendor patches for Ubuntu, Debian, and Red Hat packages where PHP is bundled or distributed.
• Restrict outbound HTTP requests from PHP applications to trusted destinations to limit exposure to attacker-controlled responses.
• Run PHP-FPM or web server worker processes with least privilege and resource limits to reduce impact of a crash or memory disclosure.

Detection

• Monitor for PHP process crashes or abnormal terminations correlated with outbound HTTP requests.
• Inspect application and web server logs for requests to untrusted or unusual HTTP endpoints made by PHP code.
• Use memory-safety tooling such as ASan or Valgrind in test environments to catch the under-read during HTTP response parsing.
• Track PHP version inventory to identify hosts still running affected releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.