A critical vulnerability has been identified in the php-pecl-http package, affecting systems running Ubuntu 16.04 LTS with version 3.0.1-0ubuntu5+esm1. This vulnerability allows remote attackers to exploit type confusion in HTTP request parameters, which could lead to PHP crashes or arbitrary code execution.
The vulnerability has been assigned a CVSS score of 9.0, indicating its critical nature. It was disclosed on November 11, 2026.
The vulnerability could possibly be exploited by a remote attacker. Users are strongly advised to update their systems to mitigate these risks.
A patch addressing this issue is available through a standard system update. Users are urged to apply this update promptly to protect their systems from potential exploitation.