How severe is CVE-2006-3016?

CVE-2006-3016 has a CVSS 2.0 base score of 9.3, rated critical severity.

Is CVE-2006-3016 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-3016?

CVE-2006-3016 affects Php Group Php. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2006-3016?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2006-3016 published?

CVE-2006-3016 was published on 2006-06-14 and last updated on 2026-06-16.

CVE-2006-3016

CVE-2006-3016 is a critical-severity vulnerability in Php Group Php with a CVSS 2.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 2.0 base score 9.3)
EPSS exploit prediction: 2% (81st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Php Group Php
Published: 2006-06-14
Last modified: 2026-06-16

Description

Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().

Frequently asked questions

What is CVE-2006-3016?: Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
How severe is CVE-2006-3016?: CVE-2006-3016 has a CVSS 2.0 base score of 9.3, rated critical severity.
Is CVE-2006-3016 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-3016?: CVE-2006-3016 affects Php Group Php. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2006-3016?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2006-3016 published?: CVE-2006-3016 was published on 2006-06-14 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*

More vulnerabilities in Php Group Php

CVE-2006-3018 — High (CVSS 7.5): Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack…
CVE-2006-7205 — Medium (CVSS 5.0): The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a…

All CVEs affecting Php Group Php →