Description
The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.
Remediation
References
Related Vulnerabilities
IBM RTC Generation of Error Message Containing Sensitive Information (CVE-2020-4487)
SharePoint URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-1323)
Nginx Out-of-bounds Write Vulnerability (CVE-2011-4315)
MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-35625)