CVE-2014-4670: Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows cont...

Security readout for executives and security teams

CVE-2014-4670 is an old PHP memory-safety flaw in the SPL list component. In certain web-hosting application contexts, crafted iterator behavior could crash PHP and may have other unspecified impact. The sources do not provide a CVSS score or confirm active exploitation. Exposure is most likely where legacy PHP through 5.5.14, or vendor packages derived from it, remain in use. Risk increases for shared hosting or applications that use SPL list iterators in paths influenced by untrusted users. Treat this as legacy technology risk rather than a confirmed emergency. If PHP through 5.5.14 is still present, prioritize remediation because unsupported PHP stacks often carry many additional vulnerabilities beyond this CVE. Mitigation focus: Inventory PHP versions across hosts, containers, and bundled application runtimes.; Apply vendor PHP security updates from the relevant distribution or platform advisory.; Retire PHP 5.5.14 or earlier where still present..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.