Critical severity · published Mar 30, 2025
CVE-2025-1861
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there…
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
8.1.0 before 8.1.31; 8.2.0 before 8.2.26; 8.3.0 before 8.3.14; 8.4.0 before 8.4.5 · source: NVD
ON
Ontap · Netapp
9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1861
Vendor Advisory
https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250523-0005/
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability