CVE-2016-7134: ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows...

Security readout for executives and security teams

CVE-2016-7134 affects PHP 7.x before 7.0.10. A very long string handled through PHP's curl escaping path can trigger a libcurl-related integer overflow condition, causing crashes and heap corruption. The confirmed business impact is denial of service; other impact is described only as possible and unspecified. Exposure is most likely in PHP 7.x applications before 7.0.10 that use ext/curl and pass attacker-influenced long strings into curl_escape behavior. The source bundle does not identify specific applications, platforms, or default exposure paths. Treat as a patching and legacy-runtime risk. It is not supported by evidence of active exploitation, but internet-facing old PHP services with curl usage should be remediated promptly because denial of service is confirmed and memory corruption is involved. Mitigation focus: Upgrade PHP 7.x deployments to PHP 7.0.10 or a later vendor-fixed release.; Apply distribution security updates where PHP is managed by the operating system vendor.; Check vendor guidance for any paired libcurl package requirements..

Prepared

Jun 13, 2026, 13:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.