In PHP versions 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, and 8.4.* before 8.4.5, headers received from an HTTP server that are missing a colon (:) are incorrectly treated as valid. This flaw can lead applications to accept invalid headers, potentially causing confusion and unexpected behavior.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-1734 |
Exploitation
To exploit this vulnerability, an attacker can craft HTTP headers that lack colons and send them to a vulnerable PHP application. If the application processes these headers without proper validation, it may accept them as valid, leading to potential application misbehavior or security issues.
Affected Products
- PHP 8.1.* before 8.1.32: Affected versions may process invalid headers incorrectly.
- PHP 8.2.* before 8.2.28: Similar issues with header validation exist.
- PHP 8.3.* before 8.3.19: Vulnerable to the same header processing flaw.
- PHP 8.4.* before 8.4.5: Also susceptible to accepting invalid headers.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of PHP that have addressed this issue. Additionally, implementing strict validation of HTTP headers in applications can help prevent the acceptance of invalid headers.