CVE-2011-0421: The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not proper...

Security readout for executives and security teams

This is an old PHP Zip extension denial-of-service flaw. A vulnerable application can crash when it processes an empty ZIP archive in certain name or stat lookup operations. It matters mainly for legacy PHP deployments that still process untrusted ZIP files. Exposure is most likely on legacy PHP before 5.3.6 with the Zip extension enabled and application paths that process attacker-supplied ZIP archives. Current, supported PHP deployments should not be affected if vendor updates were applied. Treat as a legacy exposure cleanup item unless critical services still run vulnerable PHP and process user-supplied ZIP files. The business risk is service disruption, not data theft based on the provided sources. Mitigation focus: Upgrade PHP to 5.3.6 or later, or apply vendor-supported PHP package updates.; Prioritize applications that accept ZIP uploads or process untrusted ZIP files.; If upgrading is delayed, restrict untrusted ZIP processing where business impact permits..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.