PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or…
Priority LOW 39CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
Why it matters now
EPSS 0.03514 89th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7272
- 2026-10-03 Alias added: GHSA-943r-xvqq-r4rh
References
Advisory 1
More Php vulnerabilities
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2012-01607 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
- TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
- TI-2015-00205 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… CVSS 2.0HIGH 10.0
Sources
- CVE-2017-7272 · CVE Program
- CVE-2017-7272 · NVD
- FIRST EPSS
- GHSA-943r-xvqq-r4rh · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7272 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences