CVE-2019-9020

PoC ×2—

CVSS 3.0

9.8 critical

EPSS

10%p95

Published

Feb 22, 2019 (Feb 22, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

Vendors: php debian canonical netapp opensuse
Products: php, debian linux, ubuntu linux, storage automation store, leap
Weakness: CWE-125, CWE-416
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (10.1%)

In the news0 stories

No ingested article mentions this CVE yet.