CVE-2025-1861
published 2025-03-30CVE-2025-1861: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.86%
58.1th percentile
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| debian | php8.4 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| msrc | azl3_php_8.3.14-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.19-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.31-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.32-1_on_cbl_mariner_2.0 | — | — |
| netapp | ontap | — | — |
| php | php | >= 8.1.0 < 8.1.31 | 8.1.31 |
| php | php | >= 8.2.0 < 8.2.26 | 8.2.26 |
| php | php | >= 8.3.0 < 8.3.14 | 8.3.14 |
| php | php | >= 8.4.0 < 8.4.5 | 8.4.5 |
| php_group | php | >= 8.1.* < 8.1.32 | 8.1.32 |
| php_group | php | >= 8.2.* < 8.2.28 | 8.2.28 |
| php_group | php | >= 8.3.* < 8.3.19 | 8.3.19 |
| php_group | php | >= 8.4.* < 8.4.5 | 8.4.5 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv9.2CRITICAL
vendor_msrc9.8CRITICAL
vendor_ubuntu8.1HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 3.1
CVE-2025-1736 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly parsed certain HTTP response
headers. An attacker could possibly use this issue to cause incorrect
MIME type parsing which could result in unexpected behavior.
(CVE-2025-1217)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to perform an HTTP
request smuggling attack. (CVE-2025-1734)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to prevent certain
headers from being sent which could result in a denial of service or
other unexpected behavior. (CVE-2025-1736)
It was discovered that PHP incorrectly performed URL truncation. An
attacke
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-03-31·CVSS 8.1
CVE-2025-1734 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)
It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)
It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)
It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibl
Red Hat
php: Stream HTTP wrapper truncates redirect location to 1024 bytes
vendor_redhat·2025-03-30·CVSS 6.3
CVE-2025-1861 [MEDIUM] CWE-131 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
php: Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product S
Microsoft
Stream HTTP wrapper truncates redirect location to 1024 bytes
vendor_msrc·2025-03-11·CVSS 9.8
CVE-2025-1861 [MEDIUM] CWE-131 Stream HTTP wrapper truncates redirect location to 1024 bytes
Stream HTTP wrapper truncates redirect location to 1024 bytes
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lea
Debian
CVE-2025-1861: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...
vendor_debian·2025·CVSS 6.3
CVE-2025-1861 [MEDIUM] CVE-2025-1861: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u8)
OSV
php7.0, php7.2 vulnerabilities
osv·2025-07-17·CVSS 6.3
CVE-2025-1217 [MEDIUM] php7.0, php7.2 vulnerabilities
php7.0, php7.2 vulnerabilities
It was discovered that PHP incorrectly parsed certain HTTP response
headers. An attacker could possibly use this issue to cause incorrect
MIME type parsing which could result in unexpected behavior.
(CVE-2025-1217)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to perform an HTTP
request smuggling attack. (CVE-2025-1734)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to prevent certain
headers from being sent which could result in a denial of service or
other unexpected behavior. (CVE-2025-1736)
It was discovered that PHP incorrectly performed URL truncation. An
attacker could possibly use this issue to specially craf
OSV
php7.4, php8.1, php8.3 vulnerabilities
osv·2025-03-31·CVSS 9.2
CVE-2024-11235 [CRITICAL] php7.4, php8.1, php8.3 vulnerabilities
php7.4, php8.1, php8.3 vulnerabilities
It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)
It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)
It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)
It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibly use this issue to confuse
applications
OSV
CVE-2025-1861: In PHP from 8
osv·2025-03-30·CVSS 6.3
CVE-2025-1861 [MEDIUM] CVE-2025-1861: In PHP from 8
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Suricata
ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)
suricata·2025-01-17·CVSS 5.4
CVE-2023-1861 [MEDIUM] ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)
ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-"; pcre:"/^(?:admin|login)/R"; http.cookie; content:"wordpress_"; fast_pattern; content:"|3d|"; distance:0; pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri"; reference:url,wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810/; reference:cve,2023-1861; classtype:web-application-attack; sid:2059302; rev:1; metadata:created_at 2025_01_17, cve
No public exploits indexed.
Bugzilla
CVE-2025-38285 kernel: bpf: Fix WARN() in get_bpf_raw_tp_regs
bugzilla·2025-07-10·CVSS 5.5
CVE-2025-38285 [MEDIUM] CVE-2025-38285 kernel: bpf: Fix WARN() in get_bpf_raw_tp_regs
CVE-2025-38285 kernel: bpf: Fix WARN() in get_bpf_raw_tp_regs
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix WARN() in get_bpf_raw_tp_regs
syzkaller reported an issue:
WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861
Modules linked in:
CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861
RSP: 0018:ffffc90003636fa8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c
RDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 00000000000000
Bugzilla
CVE-2025-1861 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
bugzilla·2025-03-30·CVSS 9.8
CVE-2025-1861 [CRITICAL] CVE-2025-1861 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
CVE-2025-1861 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:4263 https://access.redhat.com/errata/RHSA-2025:4263
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:7418 https://access.redha
2025-03-30
Published