Vulnerability CVE-2025-1734: Information

Description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

Fixed packages

References to Advisories, Solutions, and Tools

1. Affected configurations:
   1. cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

      Start including

      8.1.0

      End excluding

      8.1.32

      ---

      cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

      Start including

      8.2.0

      End excluding

      8.2.28

      ---

      cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

      Start including

      8.3.0

      End excluding

      8.3.19

      ---

      cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

      Start including

      8.4.0

      End excluding

      8.4.5

      ---

      cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*

      ---