CVE-2025-1735
published 2025-07-13CVE-2025-1735: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.00%
60.5th percentile
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php7.4 7.4.33-1+deb11u9 (bullseye) | php7.4 7.4.33-1+deb11u9 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u9 (bullseye) | php7.4 7.4.33-1+deb11u9 (bullseye) |
| debian | php8.4 | < php7.4 7.4.33-1+deb11u9 (bullseye) | php7.4 7.4.33-1+deb11u9 (bullseye) |
| msrc | azl3_php_8.3.23-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.32-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.33-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_vim_8.2.5064-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_vim_8.2.5064-1_on_cbl_mariner_1.0 | — | — |
| php | php | >= 8.1.0 < 8.1.33 | 8.1.33 |
| php | php | >= 8.2.0 < 8.2.29 | 8.2.29 |
| php | php | >= 8.3.0 < 8.3.23 | 8.3.23 |
| php | php | >= 8.4.0 < 8.4.10 | 8.4.10 |
| php_group | php | >= 8.1.* < 8.1.33 | 8.1.33 |
| php_group | php | >= 8.2.* < 8.2.29 | 8.2.29 |
| php_group | php | >= 8.3.* < 8.3.23 | 8.3.23 |
| php_group | php | >= 8.4.* < 8.4.10 | 8.4.10 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_msrc7.8HIGH
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP regression
vendor_ubuntu·2025-09-04·CVSS 3.7
CVE-2025-1735 [LOW] PHP regression
Title: PHP regression
Summary: USN-7648-2 introduced a regression in PHP
USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735
caused a regression in php7.0, php7.2 and php7.4. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-08-21·CVSS 3.7
CVE-2025-1220 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
USN-7648-1 fixed several vulnerabilities in PHP. This update
provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 3.7
CVE-2025-1735 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to crash, resulting in a denial of service. (CVE-2025-6491)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
pgsql extension does not check for errors during escaping
vendor_msrc·2025-07-08·CVSS 5.9
CVE-2025-1735 [MEDIUM] CWE-89 pgsql extension does not check for errors during escaping
pgsql extension does not check for errors during escaping
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.m
Red Hat
php: pgsql extension does not check for errors during escaping
vendor_redhat·2025-07-05·CVSS 5.9
CVE-2025-1735 [MEDIUM] CWE-476 php: pgsql extension does not check for errors during escaping
php: pgsql extension does not check for errors during escaping
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
A flaw was found in PHP. Missing error checking could result in SQL injection, and missing error handling could lead to crashes due to null pointer dereferences.
Mitigation: Currently, no mitigation is currently available for this vulnerability.
Package: php (Red Hat Enterprise Linux 10) - Fix deferred
Package: php (Red Hat Enterprise Linux 6) - Fix deferred
Package: php (Red Hat Enterprise Linux 7) - Fix deferred
Package: php (Red Hat Enterprise Linux 9) - Fix
Debian
CVE-2025-1735: php7.4 - In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8...
vendor_debian·2025·CVSS 5.9
CVE-2025-1735 [MEDIUM] CVE-2025-1735: php7.4 - In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8...
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u9)
Microsoft
Classic Buffer Overflow in vim/vim
vendor_msrc·2022-05-10·CVSS 7.8
CVE-2022-1735 [HIGH] CWE-120 Classic Buffer Overflow in vim/vim
Classic Buffer Overflow in vim/vim
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
@huntrdev: @huntrdev
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.co
OSV
php7.0, php7.2, php7.4 regression
osv·2025-09-04·CVSS 5.3
CVE-2025-1735 [MEDIUM] php7.0, php7.2, php7.4 regression
php7.0, php7.2, php7.4 regression
USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735
caused a regression in php7.0, php7.2 and php7.4. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use thi
OSV
php7.0, php7.2, php7.4 vulnerabilities
osv·2025-08-21·CVSS 5.3
CVE-2025-1220 [MEDIUM] php7.0, php7.2, php7.4 vulnerabilities
php7.0, php7.2, php7.4 vulnerabilities
USN-7648-1 fixed several vulnerabilities in PHP. This update
provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to
OSV
php8.1, php8.3, php8.4 vulnerabilities
osv·2025-07-17·CVSS 5.3
CVE-2025-1220 [MEDIUM] php8.1, php8.3, php8.4 vulnerabilities
php8.1, php8.3, php8.4 vulnerabilities
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to crash, resulting in a denial of service. (CVE-2025-6491)
OSV
CVE-2025-1735: In PHP versions:8
osv·2025-07-13·CVSS 7.5
CVE-2025-1735 [HIGH] CVE-2025-1735: In PHP versions:8
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-13
Published