CVE-2017-11143: In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by at...

Security readout for executives and security teams

This is a legacy PHP denial-of-service issue. If an attacker can feed crafted XML into PHP WDDX deserialization, PHP may crash. The source bundle does not show code execution, data theft, or active exploitation. Business urgency depends on whether older PHP 5.x systems still parse untrusted WDDX XML. Exposure is most likely in legacy PHP deployments before 5.6.31 that enable or use WDDX deserialization and accept XML from external or low-trust sources. Systems using vendor-packaged PHP should confirm backported fixes through their distribution or appliance vendor. Prioritize remediation for internet-facing or partner-facing legacy PHP services that process XML. Treat this as an availability risk, not proven data compromise. Lower priority if WDDX is absent, PHP is fixed, or untrusted XML cannot reach deserialization. Mitigation focus: Upgrade PHP to 5.6.31 or a vendor-supported fixed build.; Apply relevant distribution advisories, including Red Hat or Debian fixes where applicable.; Check NetApp guidance for products that bundle affected PHP components..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.