CVE-2016-4345: Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0...

Security readout for executives and security teams

This issue affects PHP before 7.0.4. A very long input string processed by PHP’s URL filter encoding logic can corrupt memory, potentially crashing the service. The public sources describe denial of service and possible unspecified impact, but do not provide proof of broader compromise. Exposure is most likely where PHP before 7.0.4 processes attacker-controlled strings through the affected filter sanitization path. The provided affected-product metadata is incomplete, so confirm exposure through runtime versions and application code review. Schedule remediation for affected PHP systems, especially internet-facing applications. Business urgency is moderate because the confirmed impact is service disruption, while broader impact and exploitation evidence are not established in the supplied sources. Mitigation focus: Upgrade PHP runtimes from versions before 7.0.4 to a fixed vendor-supported release.; Review PHP changelog and distribution advisories for package-specific backports.; Reduce exposure of endpoints processing untrusted long strings until updated..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.