CVE-2016-5873

Name: CVE-2016-5873
Creator: NVD / NIST
Published: 2017-01-23T21:59:01.813+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 4.70%

Last modified Jun 17, 2026

CVE-2016-5873 is a vulnerability of currently unknown severity. Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.. EPSS estimates a 4.70% chance of exploitation in the next 30 days.

Description

Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.

Metrics

EPSS Probability

4.70%

90.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions	Update
Php	Pecl Http	<= 3.0.1	Rc1

References

http://www.openwall.com/lists/oss-security/2016/06/29/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/29/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/95863
https://bugs.php.net/bug.php?id=71719Exploit, Vendor Advisory
https://github.com/m6w6/ext-http/commit/3724cd76a28be1d6049b5537232e97acPatch, Vendor Advisory
https://pecl.php.net/package/pecl_http/3.0.1Release Notes, Vendor Advisory
https://security.gentoo.org/glsa/201612-17
https://security.netapp.com/advisory/ntap-20180112-0001/
http://www.openwall.com/lists/oss-security/2016/06/29/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/29/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/95863
https://bugs.php.net/bug.php?id=71719Exploit, Vendor Advisory
https://github.com/m6w6/ext-http/commit/3724cd76a28be1d6049b5537232e97acPatch, Vendor Advisory
https://pecl.php.net/package/pecl_http/3.0.1Release Notes, Vendor Advisory
https://security.gentoo.org/glsa/201612-17
https://security.netapp.com/advisory/ntap-20180112-0001/

Timeline

Published: Jan 23, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-5873?

Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.

How severe is CVE-2016-5873?

Severity scoring for CVE-2016-5873 is pending analysis. The EPSS model estimates a 4.70% probability of exploitation in the next 30 days.

How do I fix CVE-2016-5873?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2016

View all 2016CVEs →

Are you affected by CVE-2016-5873?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST