CVE-2025-1861

CWE-131CWE-476 — NULL Pointer Dereference10 documents7 sources
Severity
6.3MEDIUM
EPSS
0.9%
top 23.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PHP Group PHPPHP PHPNetapp Ontap
Timeline
PublishedMar 30
Latest updateJul 17

Description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDphp/php8.1.0 — 8.1.31+3
▶CVEListV5php_group/php8.1.* — 8.1.32+3
▶Debianphp7.4< 7.4.33-1+deb11u8
▶Debianphp8.2< 8.2.28-1~deb12u1
▶Debianphp8.4< 8.4.5-1+1

Also affects: Ontap 9

🔴Vulnerability Details

2
CVEList
Stream HTTP wrapper truncates redirect location to 1024 bytes↗2025-03-30
▶
OSV
CVE-2025-1861: In PHP from 8↗2025-03-30
▶

📋Vendor Advisories

5
Ubuntu
PHP vulnerabilities↗2025-07-17
▶
Ubuntu
PHP vulnerabilities↗2025-03-31
▶
Red Hat
php: Stream HTTP wrapper truncates redirect location to 1024 bytes↗2025-03-30
▶
Microsoft
Stream HTTP wrapper truncates redirect location to 1024 bytes↗2025-03-11
▶
Debian
CVE-2025-1861: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...↗2025
▶