CVE-2016-5385

CVE-2016-5385, also known as "httpoxy," is a critical vulnerability affecting PHP versions through 7.0.8, as well as various products like Debian, Drupal, and Oracle. It stems from PHP's failure to properly handle namespace conflicts, allowing untrusted client data in the HTTP_PROXY environment variable to redirect an application's outbound HTTP traffic to an arbitrary proxy. With a CVSS score of 8.1 (HIGH), this vulnerability is remotely exploitable with high impact on confidentiality, integrity, and availability, but requires high attack complexity. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating widespread awareness despite its inactive status on the KEV catalog.