$ cve CVE-2004-0594 JSON

CVE-2004-0594 EXPLOIT

5.1

MEDIUM · CVSS 2.0 · EPSS 54.9% (pctl 99)

Patch early

A public exploit exists.

Description

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

Scoring

CVSS	5.1 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS	54.86% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-367
On CISA KEV	no
Public exploit	yes
Published	2004-07-27
Last modified	2026-06-16

Affected (6)

Vendor	Product
avaya	converged communications server
debian	debian linux
hp	hp-ux
openpkg	openpkg
php	php
trustix	secure linux

Public exploits

Source	Title	Date
exploit-db	PHP 4.3.7/5.0.0RC3 - 'memory_limit' Remote Overflow	2004-11-27

References

→ the Explorer · watch your stack · NVD