Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2025-1736

Stream HTTP wrapper header check might omit basic auth header

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: affected

  • 8.1.* to < 8.1.32affected
  • 8.2.* to < 8.2.28affected
  • 8.3.* to < 8.3.19affected
  • 8.4.* to < 8.4.5affected

References