CVE-2025-1861

CRITICAL

9.8

Beschreibung

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/30/2025

Zuletzt geandert11/3/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

netapp:ontapphp:php

Schwachen (CWE)

CWE-131

Referenzen

https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff(security@php.net)

https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20250523-0005/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.