CVE-2025-1217

Name of the Vulnerable Software and Affected Versions PHP versions 8.1.* through 8.1.31 PHP versions 8.2.* through 8.2.27 PHP versions 8.3.* through 8.3.18 PHP versions 8.4.* through 8.4.4

Description The issue is related to the incorrect parsing of folded headers in HTTP responses by the http request module in PHP. This may lead to misinterpreting the response and using incorrect headers, MIME types, etc. The vulnerability can be exploited by a remote attacker to send hidden HTTP requests.

Recommendations For PHP versions 8.1.* through 8.1.31, update to version 8.1.32 or later. For PHP versions 8.2.* through 8.2.27, update to version 8.2.28 or later. For PHP versions 8.3.* through 8.3.18, update to version 8.3.19 or later. For PHP versions 8.4.* through 8.4.4, update to version 8.4.5 or later. As a temporary workaround, consider restricting access to the http stream wrapper until a patch is available.