CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to stri...

Security readout for executives and security teams

CVE-2017-8923 is a PHP engine bug affecting PHP through 7.1.5. A script that appends a very long string with .= could trigger invalid internal string length handling. The documented business impact is denial of service from an application crash; sources also mention possible unspecified other impact, but details are incomplete. Most relevant to legacy PHP deployments at or below 7.1.5, especially public applications that process large user-controlled input and append it to strings. Downstream appliance exposure should be checked against vendor advisories such as NetApp's notice. Treat as a legacy platform risk with availability impact. It is not listed as actively exploited in the provided sources, but exposed PHP through 7.1.5 should be removed or upgraded because the vulnerable branch is old and the documented outcome is application crash. Mitigation focus: Inventory PHP runtimes and flag versions through 7.1.5.; Check PHP project guidance and vendor advisories for fixed or supported versions.; Prioritize upgrading unsupported PHP runtimes to maintained releases..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.