Malformed HTTP Response Vulnerability in PHP Products
CVE-2025-1217

6.3MEDIUM

Key Information:

Vendor
PHP Group
Status
PHP
Vendor
CVE Published:
29 March 2025

Summary

An issue has been identified in PHP versions prior to 8.1.32, 8.2.28, 8.3.19, and 8.4.5 where the http request module incorrectly parses folded HTTP response headers. This flaw could lead to misinterpretation of server responses, potentially resulting in the use of incorrect headers or MIME types, thus posing a risk to application security and data integrity.

Affected Version(s)

PHP 8.1.*

PHP 8.1.* < 8.1.32

PHP 8.2.* < 8.2.28

References

https://github.com/php/php-src/security/advisories/GHSA-v...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim DĂĽsterhus
.