What’s Vulnerable › Vulnerabilities

CVE-2017-9118

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-08-02 · updated 2026-06-17
• Weakness: CWE-125

Description

PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

Affected products

• NetApp Storage Automation Store: all versions
• PHP: from 7.4.0 before 7.4.27; from 8.0.0 before 8.0.14; from 8.1.0 before 8.1.1; 7.1.5 — fixed in 7.4.27, 8.0.14, 8.1.1

How to fix

Upgrade to a fixed version: PHP 7.4.27, 8.0.14, 8.1.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=74604
• https://security.netapp.com/advisory/ntap-20181107-0003/
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=74604
• https://security.netapp.com/advisory/ntap-20181107-0003/

Get alerted when CVE-2017-9118 or the next vulnerability affects your stack