CVE-2012-0788: The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which al...

Security readout for executives and security teams

CVE-2012-0788 is an old PHP flaw that can crash an application server when vulnerable PHP code combines PDO row fetching with session startup. The documented impact is denial of service, not data theft or code execution. Business urgency depends on whether any internet-facing service still runs PHP before 5.3.9. Exposure is most likely in legacy PHP deployments before 5.3.9, especially applications using PDO and sessions in reachable request paths. Modern supported PHP versions should not be assumed affected from the supplied evidence. Treat this as a legacy exposure cleanup item unless vulnerable PHP is still internet-facing. It can affect availability, but the supplied evidence does not indicate active exploitation or compromise of confidentiality or integrity. Mitigation focus: Upgrade PHP workloads running before 5.3.9 to a supported fixed release.; Check SUSE, openSUSE, Red Hat, and PHP guidance for package-specific fixes.; Prioritize internet-facing applications that use PDO and PHP sessions..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.