CVE-2017-11142: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consump...

Security readout for executives and security teams

This is a PHP denial-of-service flaw. A remote attacker could make vulnerable PHP applications spend excessive CPU processing long form variables, potentially slowing or exhausting web service capacity. The provided sources do not show data theft, code execution, or confirmed active exploitation. Exposure is most likely on internet-facing PHP applications still running PHP versions before 5.6.31, 7.0.17, or 7.1.3. The source bundle does not identify specific applications as affected beyond PHP itself and downstream vendor advisories. Treat as a moderate availability risk. It is old, but systems still running these PHP branches may be fragile and internet-exposed. Prioritize remediation where downtime would affect customers or operations. Mitigation focus: Upgrade PHP to 5.6.31, 7.0.17, 7.1.3, or later fixed releases.; Prefer migration from unsupported PHP branches to maintained releases.; Review Debian, NetApp, and application vendor advisories for packaged fixes..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.