CVE-2015-4024: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP befo...

Security readout for executives and security teams

CVE-2015-4024 is a PHP denial-of-service issue. A remote attacker could send specially crafted form data that makes vulnerable PHP versions spend excessive CPU processing multipart request headers, potentially slowing or disrupting web services that handle form uploads. Exposure is most likely on internet-facing PHP applications running the affected PHP release ranges and accepting multipart/form-data requests, such as upload or form submission endpoints. The provided affected-product metadata is incomplete, so confirm exposure through runtime and package inventory. Treat this as a moderate availability risk for legacy PHP estates. It warrants prompt patch verification where old PHP versions remain exposed, especially on customer-facing upload or form workflows, but the provided sources do not support claims of active exploitation or data compromise. Mitigation focus: Upgrade PHP to 5.4.41, 5.5.25, 5.6.9, or later supported vendor packages.; Apply relevant distribution advisories from Red Hat, openSUSE, Debian, Oracle, Apple, Fedora, or HPE as applicable.; Prioritize internet-facing PHP services that process uploads or multipart form submissions..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.