CVE-2018-17082

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.

• CWE-79

• http://php.net/ChangeLog-5.phpRelease Notes
• http://php.net/ChangeLog-7.phpRelease Notes
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=76582Exploit, Issue Tracking, Vendor Advisory
• https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214ePatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00020.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201812-01Third Party Advisory
• https://security.netapp.com/advisory/ntap-20180924-0001/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4353Third Party Advisory
• https://www.tenable.com/security/tns-2019-07
• http://php.net/ChangeLog-5.phpRelease Notes
• http://php.net/ChangeLog-7.phpRelease Notes
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=76582Exploit, Issue Tracking, Vendor Advisory
• https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214ePatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00020.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201812-01Third Party Advisory
• https://security.netapp.com/advisory/ntap-20180924-0001/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4353Third Party Advisory
• https://www.tenable.com/security/tns-2019-07

Published

Sep 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17075The html package (aka x/net/html) before 2018-07-13 in Go mi…7.5
• CVE-2018-17076GPP through 2.25 will try to use more memory space than is a…
• CVE-2018-17077An issue was discovered in yiqicms through 2016-11-20. There…
• CVE-2018-17079An issue was discovered in ZRLOG 2.0.1. There is a Stored XS…
• CVE-2018-1708IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow an authe…6.5
• CVE-2018-17081e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&act…
• CVE-2018-17085An issue was discovered in OTCMS 3.61. XSS exists in admin/u…
• CVE-2018-17086An issue was discovered in OTCMS 3.61. XSS exists in admin/s…
• CVE-2018-17088The ProcessGpsInfo function of the gpsinfo.c file of jhead 3…
• CVE-2018-17090An issue was discovered in DonLinkage 6.6.8. The modules /pa…
• CVE-2018-17091An issue was discovered in DonLinkage 6.6.8. It allows remot…
• CVE-2018-17092An issue was discovered in DonLinkage 6.6.8. SQL injection i…