A security vulnerability has been found in specific versions of PHP, the software that powers most dynamic websites, when running on Windows servers. It impacts PHP 7.3.x versions older than 7.3.13, as well as PHP 7.4.0. PHP’s built-in mail() function, which websites use to send automated emails like contact form responses, password reset links, and order confirmations, is affected by this flaw.
The bug is triggered when a website passes custom email headers to the mail() function written entirely in lowercase letters. This coding error causes the system to accidentally release the same block of memory twice, a type of issue that can lead to unexpected crashes of the website or the server it is hosted on.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2019-11049
