Servers and applications
CVE-2015-6835 The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Severity Critical 9.8
Published 16 May 2016
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.6.12 Version 5.6.11 Version 5.6.10 Version 5.6.9 All 63 release lines Every version up to 5.4.44 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.5.18 Version 5.5.19 Version 5.5.20 Version 5.5.21 Version 5.5.22 Version 5.5.23 Version 5.5.24 Version 5.5.25 Version 5.5.26 Version 5.5.27 Version 5.5.28 Version 5.6.0-alpha1 Version 5.6.0-alpha2 Version 5.6.0-alpha3 Version 5.6.0-alpha4 Version 5.6.0-alpha5 Version 5.6.0-beta1 Version 5.6.0-beta2 Version 5.6.0-beta3 Version 5.6.0-beta4 Version 5.6.1 Version 5.6.2 Version 5.6.3 Version 5.6.4 Version 5.6.5 Version 5.6.6 Version 5.6.7 Version 5.6.8 Version 5.6.9 Version 5.6.10 Version 5.6.11 Version 5.6.12
References NVD https://nvd.nist.gov/vuln/detail/CVE-2015-6835 CVE.org https://www.cve.org/CVERecord?id=CVE-2015-6835