CVE-2009-4418

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-24 · updated 2026-06-16
Weakness: CWE-189

Description

The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.

Affected products

PHP: through 5.3.0; 5, 5.0-rc1, 5.0-rc2, 5.0-rc3, 5.0.0, 5.0.0-beta1 (+30)

References

http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/
http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf
http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/
http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf

Get alerted when CVE-2009-4418 or the next vulnerability affects your stack