CVE-2007-4783: The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial...

Security readout for executives and security teams

This is an old PHP denial-of-service issue in iconv_substr. If an application passes very long attacker-controlled strings into affected PHP versions, it may crash or temporarily hang. The source record notes this may not matter in many multi-threaded web server environments unless stronger impact is demonstrated. Likely limited to legacy PHP 5.2.4-or-earlier deployments and code paths that call iconv_substr with attacker-influenced charset or string values. Modern maintained PHP stacks are less likely exposed, but legacy embedded appliances or abandoned web applications should be checked. Address during legacy-platform risk reduction unless exposed internet-facing PHP 5.2.4-or-earlier systems are found. If exposed legacy systems exist, prioritize remediation because a simple availability failure can disrupt customer-facing services. Mitigation focus: Inventory PHP runtimes and flag PHP 5.2.4 or earlier.; Review vendor advisories for supported fixed packages or upgrade guidance.; Limit attacker control over iconv_substr charset and string inputs..

Prepared

Jun 29, 2026, 03:38 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.