UpHeron
All vulnerabilities

Servers and applications

CVE-2016-6290

ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.

Severity
Critical 9.8
Published
25 Jul 2016
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 7.0.8
  • Version 7.0.5
  • Version 7.0.4
  • Version 7.0.3
All 40 release lines
  • Every version up to 5.5.37
  • Version 5.6.0-alpha1
  • Version 5.6.0-alpha2
  • Version 5.6.0-alpha3
  • Version 5.6.0-alpha4
  • Version 5.6.0-alpha5
  • Version 5.6.0-beta1
  • Version 5.6.0-beta2
  • Version 5.6.0-beta3
  • Version 5.6.0-beta4
  • Version 5.6.1
  • Version 5.6.2
  • Version 5.6.3
  • Version 5.6.4
  • Version 5.6.5
  • Version 5.6.6
  • Version 5.6.7
  • Version 5.6.8
  • Version 5.6.9
  • Version 5.6.10
  • Version 5.6.11
  • Version 5.6.12
  • Version 5.6.13
  • Version 5.6.14
  • Version 5.6.15
  • Version 5.6.16
  • Version 5.6.17
  • Version 5.6.18
  • Version 5.6.19
  • Version 5.6.20
  • Version 5.6.21
  • Version 5.6.22
  • Version 5.6.23
  • Version 7.0.0
  • Version 7.0.1
  • Version 7.0.2
  • Version 7.0.3
  • Version 7.0.4
  • Version 7.0.5
  • Version 7.0.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-6290
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-6290