CVE-2016-4343: The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandl...

Security readout for executives and security teams

CVE-2016-4343 is a PHP Phar/TAR handling bug. A malicious TAR archive with a malformed zero-size LongLink entry can crash affected PHP versions, causing denial of service. Public sources identify fixes in PHP 5.6.18 and 7.0.3; they do not confirm real-world exploitation. Exposure is most likely where legacy PHP applications or services process untrusted TAR, Phar, or archive content using affected PHP runtimes. Modern supported PHP versions should not be exposed to this specific fixed defect. Treat this as a legacy PHP cleanup and availability risk. Prioritize systems that accept archives from users or partners. Urgency rises if affected PHP versions remain internet-facing or embedded in vendor appliances. Mitigation focus: Upgrade PHP to at least 5.6.18 or 7.0.3, preferably a supported current release.; Apply vendor security updates from your OS or appliance provider where PHP is packaged.; Restrict untrusted archive upload or parsing paths until affected runtimes are removed..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.