CVE-2007-3205: The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second paramete...

Security readout for executives and security teams

This issue concerns older PHP-related code that uses parse_str without a destination array. If attacker-controlled text is parsed this way, variable names inside that text may overwrite existing application variables, potentially changing security decisions. Exposure is most likely in legacy PHP applications or libraries that call parse_str with one argument on user-controlled input. The source bundle does not identify specific affected versions or default vulnerable configurations. Treat this as a targeted legacy-code review item, not a broad emergency. Prioritize internet-facing PHP applications and any code path where request data can influence security-sensitive variables. Mitigation focus: Review vendor guidance for PHP, Hardened-PHP, and Suhosin versions in use.; Refactor single-argument parse_str calls to parse into an explicit result array.; Do not parse attacker-controlled strings into the current variable scope..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.