CVE-2010-4645: strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other prod...

Security readout for executives and security teams

This flaw can make affected PHP runtimes hang when they parse a particular floating-point number format. The business impact is denial of service: a web request or data path that accepts numeric input could consume CPU and stop responding until the process is restarted or patched. Primary exposure is legacy PHP 5.2 or 5.3 installations below the fixed versions, especially public web applications that parse user-controlled numeric strings. The source bundle says other products may be affected through reused strtod.c code, but does not provide a complete product list. Treat this as a legacy exposure cleanup item unless affected internet-facing services still exist. It is not a data-theft issue in the sources, but it can cause service outages on vulnerable systems and should be removed from supported environments. Mitigation focus: Upgrade PHP 5.2 to 5.2.17 or later, or PHP 5.3 to 5.3.5 or later.; Apply relevant vendor advisories for packaged PHP or dependent products.; Inventory applications and appliances that embed legacy PHP or reused strtod.c code..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.