CVE-2025-1217 — Header parser of http stream wrapper does not handle folded headers

Affected: PHP Group PHP

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.

USN-7400-1 — php7.4, php8.1, php8.3 vulnerabilities

Affected: Ubuntu:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3

It was discovered that PHP incorrectly handle certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2024-11235)

It was discovered that PHP incorrectly handle certain folded headers. An attacker could possibly use this issue to cause a crash or execute arbritrary code. (CVE-2025-1217)

It was discovered that PHP incorrectly handled certain headers. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)

It was discovered that PHP incorrectly handle certain headers with invalid name and no colon. An attacker could possibly use this issue to confuse applications into accepting invalid headers causing code injection. (CVE-2025-1734)

It was discovered that PHP incorrectly handled certain headers. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1736)

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2025-1861)

Most recent entries from all

CVE-2025-1217 — Header parser of http stream wrapper does not handle folded headers

USN-7400-1 — php7.4, php8.1, php8.3 vulnerabilities