CVE-2009-1271: The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to caus...

Security readout for executives and security teams

This is an old PHP denial-of-service flaw. If a vulnerable PHP 5.2.x application passes malformed attacker-controlled text into json_decode, the PHP process can crash. The business impact is service disruption, not data theft or remote code execution based on the supplied evidence. Exposure is mainly legacy PHP 5.2.x systems, especially applications that parse untrusted JSON from web requests, APIs, or integrations. Modern supported PHP versions should not be exposed to this specific 2009 issue. Asset discovery matters because old embedded or unmanaged systems may persist. Medium priority for most organizations because this is a denial-of-service issue in very old PHP. Raise priority if legacy PHP 5.2.x systems are internet-facing or support critical services. Mitigation focus: Upgrade PHP to 5.2.9 or later vendor-patched packages.; Prioritize internet-facing PHP 5.2.x applications that parse JSON.; Review Debian, Red Hat, Fedora, Ubuntu, Apple, or distro-specific advisories..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.