CVE-2025-1861
published 2025-03-30CVE-2025-1861: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.82%
53.2th percentile
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| debian | php8.4 | < php7.4 7.4.33-1+deb11u8 (bullseye) | php7.4 7.4.33-1+deb11u8 (bullseye) |
| msrc | azl3_php_8.3.14-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.19-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.31-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.32-1_on_cbl_mariner_2.0 | — | — |
| netapp | ontap | — | — |
| php | php | >= 8.1.0 < 8.1.31 | 8.1.31 |
| php | php | >= 8.2.0 < 8.2.26 | 8.2.26 |
| php | php | >= 8.3.0 < 8.3.14 | 8.3.14 |
| php | php | >= 8.4.0 < 8.4.5 | 8.4.5 |
| php_group | php | >= 8.1.* < 8.1.32 | 8.1.32 |
| php_group | php | >= 8.2.* < 8.2.28 | 8.2.28 |
| php_group | php | >= 8.3.* < 8.3.19 | 8.3.19 |
| php_group | php | >= 8.4.* < 8.4.5 | 8.4.5 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv9.2CRITICAL
vendor_msrc9.8CRITICAL
vendor_ubuntu8.1HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 3.1
CVE-2025-1736 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly parsed certain HTTP response
headers. An attacker could possibly use this issue to cause incorrect
MIME type parsing which could result in unexpected behavior.
(CVE-2025-1217)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to perform an HTTP
request smuggling attack. (CVE-2025-1734)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to prevent certain
headers from being sent which could result in a denial of service or
other unexpected behavior. (CVE-2025-1736)
It was discovered that PHP incorrectly performed URL truncation. An
attacke
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-03-31·CVSS 8.1
CVE-2025-1734 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)
It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)
It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)
It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibl
Red Hat
php: Stream HTTP wrapper truncates redirect location to 1024 bytes
vendor_redhat·2025-03-30·CVSS 6.3
CVE-2025-1861 [MEDIUM] CWE-131 php: Stream HTTP wrapper truncates redirect location to 1024 bytes
php: Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product S
Microsoft
Stream HTTP wrapper truncates redirect location to 1024 bytes
vendor_msrc·2025-03-11·CVSS 9.8
CVE-2025-1861 [MEDIUM] CWE-131 Stream HTTP wrapper truncates redirect location to 1024 bytes
Stream HTTP wrapper truncates redirect location to 1024 bytes
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lea
Debian
CVE-2025-1861: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...
vendor_debian·2025·CVSS 6.3
CVE-2025-1861 [MEDIUM] CVE-2025-1861: php7.4 - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3...
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u8)
OSV
php7.0, php7.2 vulnerabilities
osv·2025-07-17·CVSS 6.3
CVE-2025-1217 [MEDIUM] php7.0, php7.2 vulnerabilities
php7.0, php7.2 vulnerabilities
It was discovered that PHP incorrectly parsed certain HTTP response
headers. An attacker could possibly use this issue to cause incorrect
MIME type parsing which could result in unexpected behavior.
(CVE-2025-1217)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to perform an HTTP
request smuggling attack. (CVE-2025-1734)
It was discovered that PHP did not properly validate certain HTTP
headers. An attacker could possibly use this issue to prevent certain
headers from being sent which could result in a denial of service or
other unexpected behavior. (CVE-2025-1736)
It was discovered that PHP incorrectly performed URL truncation. An
attacker could possibly use this issue to specially craf
OSV
php7.4, php8.1, php8.3 vulnerabilities
osv·2025-03-31·CVSS 9.2
CVE-2024-11235 [CRITICAL] php7.4, php8.1, php8.3 vulnerabilities
php7.4, php8.1, php8.3 vulnerabilities
It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)
It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)
It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)
It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibly use this issue to confuse
applications
OSV
CVE-2025-1861: In PHP from 8
osv·2025-03-30·CVSS 6.3
CVE-2025-1861 [MEDIUM] CVE-2025-1861: In PHP from 8
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Suricata
ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)
suricata·2025-01-17·CVSS 5.4
CVE-2023-1861 [MEDIUM] ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)
ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-"; pcre:"/^(?:admin|login)/R"; http.cookie; content:"wordpress_"; fast_pattern; content:"|3d|"; distance:0; pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri"; reference:url,wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810/; reference:cve,2023-1861; classtype:web-application-attack; sid:2059302; rev:1; metadata:created_at 2025_01_17, cve
No public exploits indexed.
2025-03-30
Published