CVE-2025-1736
published 2025-03-30CVE-2025-1736: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the…
PriorityP341high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.53%
41.1th percentile
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| debian | php8.4 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| msrc | azl3_php_8.3.14-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.19-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.31-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.32-1_on_cbl_mariner_2.0 | — | — |
| netapp | ontap | — | — |
| php | php | >= 8.1.0 < 8.1.32 | 8.1.32 |
| php | php | >= 8.2.0 < 8.2.28 | 8.2.28 |
| php | php | >= 8.3.0 < 8.3.19 | 8.3.19 |
| php | php | >= 8.4.0 < 8.4.5 | 8.4.5 |
| php_group | php | >= 8.1.* < 8.1.32 | 8.1.32 |
| php_group | php | >= 8.2.* < 8.2.28 | 8.2.28 |
| php_group | php | >= 8.3.* < 8.3.19 | 8.3.19 |
| php_group | php | >= 8.4.* < 8.4.5 | 8.4.5 |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv9.2CRITICAL
vendor_ubuntu8.1HIGH
vendor_msrc7.3HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
php7.0, php7.2 vulnerabilities
osv·2025-07-17·CVSS 6.3
CVE-2025-1217 [MEDIUM] php7.0, php7.2 vulnerabilities
php7.0, php7.2 vulnerabilities
It was discovered that PHP incorrectly parsed certain HTTP response
headers. An attacker could possibly use this issue to cause incorrect
MIME type parsing which could result in unexpected behavior.
(CVE-2025-1217)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to perform an HTTP
request smuggling attack. (CVE-2025-1734)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to prevent certain
headers from being sent which could result in a denial of service or
other unexpected behavior. (CVE-2025-1736)
It was discovered that PHP incorrectly performed URL truncation. An
attacker could possibly use this issue to specially craf
OSV
php7.4, php8.1, php8.3 vulnerabilities
osv·2025-03-31·CVSS 9.2
CVE-2024-11235 [CRITICAL] php7.4, php8.1, php8.3 vulnerabilities
php7.4, php8.1, php8.3 vulnerabilities
It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)
It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)
It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)
It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibly use this issue to confuse
applications
OSV
CVE-2025-1736: In PHP from 8
osv·2025-03-30·CVSS 6.3
CVE-2025-1736 [MEDIUM] CVE-2025-1736: In PHP from 8
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 3.1
CVE-2025-1736 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly parsed certain HTTP response
headers. An attacker could possibly use this issue to cause incorrect
MIME type parsing which could result in unexpected behavior.
(CVE-2025-1217)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to perform an HTTP
request smuggling attack. (CVE-2025-1734)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to prevent certain
headers from being sent which could result in a denial of service or
other unexpected behavior. (CVE-2025-1736)
It was discovered that PHP incorrectly performed URL truncation. An
attacke
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-03-31·CVSS 8.1
CVE-2025-1734 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)
It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)
It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)
It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibl
Red Hat
php: Stream HTTP wrapper header check might omit basic auth header
vendor_redhat·2025-03-30·CVSS 6.3
CVE-2025-1736 [MEDIUM] CWE-20 php: Stream HTTP wrapper header check might omit basic auth header
php: Stream HTTP wrapper header check might omit basic auth header
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
A flaw was found in PHP. This vulnerability allows certain headers to be either not sent or misinterpreted due to insufficient validation of the end-of-line characters via user-supplied headers.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stabi
Microsoft
Stream HTTP wrapper header check might omit basic auth header
vendor_msrc·2025-03-11·CVSS 7.3
CVE-2025-1736 [MEDIUM] CWE-20 Stream HTTP wrapper header check might omit basic auth header
Stream HTTP wrapper header check might omit basic auth header
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lea
Debian
CVE-2025-1736: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...
vendor_debian·2025·CVSS 6.3
CVE-2025-1736 [MEDIUM] CVE-2025-1736: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u8)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-30
Published