Security readout for executives and security teams
Plain-English summary
This is a disputed denial-of-service issue in PHP's GMP interface through 7.1.4. If an application lets users submit very long strings to GMP operations, memory use may grow until the application aborts or crashes. The vendor argued GMP handles out-of-memory safely and that the real issue is allowing unbounded allocations.
Executive priority
Treat this as availability risk, not a confirmed compromise path. Prioritize if public PHP services process arbitrary numeric strings with GMP, especially on legacy PHP versions. Otherwise handle through routine hardening and supported-runtime upgrades.
Technical view
The report concerns PHP GMP operations on long strings causing memory consumption and application crash. The public metadata provides no CVSS, CWE, exploit evidence, or confirmed fix. The CVE note records vendor dispute: GMP safely aborts on OOM, but unbounded attacker-controlled allocation remains a denial-of-service condition.
Likely exposure
Exposure is most likely in PHP applications using the GMP extension where external input can reach large-number operations without strict size limits. Structured affected-product metadata is incomplete, so confirm actual PHP and extension usage locally.
Exploitation context
No active exploitation is cited in the supplied sources, and the CVE is not listed as KEV. The only described impact is denial of service through excessive memory consumption, not code execution or data disclosure.
Researcher notes
Evidence is thin and includes a vendor dispute. Avoid overstating affected scope beyond PHP GMP interfaces through 7.1.4 as described. The strongest validation path is code review for unbounded input into GMP-backed operations and operational evidence of memory exhaustion.
Mitigation direction
- Check PHP vendor guidance for GMP behavior and supported-version status.
- Enforce strict length limits before passing user-controlled strings to GMP operations.
- Apply application memory and request limits appropriate for public endpoints.
- Upgrade unsupported PHP runtimes as part of normal exposure reduction.
Validation and detection
- Inventory services using PHP GMP, especially public request handlers.
- Review code paths where user input reaches GMP operations.
- Confirm input-size controls exist before expensive numeric conversions.
- Check logs for repeated memory exhaustion or application aborts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-7963 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.php.net/bug.php?id=74308CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.