p PatchFirst

CVE-2025-1861

CVE-2025-1861 · Stream HTTP wrapper truncates redirect location to 1024 bytes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

CVSS 6.3 · Medium · EPSS 0.9% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • php

    Versions
    • ≥ 8.1.*, < 8.1.32: Affected (semver)
    • ≥ 8.2.*, < 8.2.28: Affected (semver)
    • ≥ 8.3.*, < 8.3.19: Affected (semver)
    • ≥ 8.4.*, < 8.4.5: Affected (semver)

    Update to 8.1.32; Update to 8.2.28; Update to 8.3.19; Update to 8.4.5

  • php8.2 Debian:12

    Versions
    • 8.2.10-1
    • 8.2.10-2
    • 8.2.12-1
    • 8.2.16-1
    • 8.2.16-2
    • 8.2.17-1
    • 8.2.18-1
    • 8.2.18-1~deb12u1
    • 8.2.20-1~deb12u1
    • 8.2.20-2
    • 8.2.20-3
    • 8.2.21-1
    • 8.2.23-1
    • 8.2.24-1
    • 8.2.24-1~deb12u1
    • 8.2.26-1~deb12u1
    • 8.2.26-4
    • 8.2.27-1
    • 8.2.5-2
    • 8.2.7-1
    • 8.2.7-1.1
    • 8.2.7-1.2
    • 8.2.7-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 8.2.28-1~deb12u1

    Update to 8.2.28-1~deb12u1

  • php8.4 Debian:13

    Affected ranges
    • ECOSYSTEM: < 8.4.5-1

    Update to 8.4.5-1

  • php8.4 Debian:14

    Affected ranges
    • ECOSYSTEM: < 8.4.5-1

    Update to 8.4.5-1

  • php5 Ubuntu:Pro:14.04:LTS

    Versions
    • 5.5.3+dfsg-1ubuntu2
    • 5.5.3+dfsg-1ubuntu3
    • 5.5.6+dfsg-1ubuntu1
    • 5.5.6+dfsg-1ubuntu2
    • 5.5.8+dfsg-2ubuntu1
    • 5.5.9+dfsg-1ubuntu1
    • 5.5.9+dfsg-1ubuntu2
    • 5.5.9+dfsg-1ubuntu3
    • 5.5.9+dfsg-1ubuntu4
    • 5.5.9+dfsg-1ubuntu4.1
    • 5.5.9+dfsg-1ubuntu4.2
    • 5.5.9+dfsg-1ubuntu4.3
    • 5.5.9+dfsg-1ubuntu4.4
    • 5.5.9+dfsg-1ubuntu4.5
    • 5.5.9+dfsg-1ubuntu4.6
    • 5.5.9+dfsg-1ubuntu4.7
    • 5.5.9+dfsg-1ubuntu4.9
    • 5.5.9+dfsg-1ubuntu4.11
    • 5.5.9+dfsg-1ubuntu4.12
    • 5.5.9+dfsg-1ubuntu4.13
    • 5.5.9+dfsg-1ubuntu4.14
    • 5.5.9+dfsg-1ubuntu4.16
    • 5.5.9+dfsg-1ubuntu4.17
    • 5.5.9+dfsg-1ubuntu4.19
    • 5.5.9+dfsg-1ubuntu4.20
    • 5.5.9+dfsg-1ubuntu4.21
    • 5.5.9+dfsg-1ubuntu4.22
    • 5.5.9+dfsg-1ubuntu4.23
    • 5.5.9+dfsg-1ubuntu4.24
    • 5.5.9+dfsg-1ubuntu4.25
    • 5.5.9+dfsg-1ubuntu4.26
    • 5.5.9+dfsg-1ubuntu4.27
    • 5.5.9+dfsg-1ubuntu4.29
    • 5.5.9+dfsg-1ubuntu4.29+esm1
    • 5.5.9+dfsg-1ubuntu4.29+esm2
    • 5.5.9+dfsg-1ubuntu4.29+esm3
    • 5.5.9+dfsg-1ubuntu4.29+esm4
    • 5.5.9+dfsg-1ubuntu4.29+esm5
    • 5.5.9+dfsg-1ubuntu4.29+esm6
    • 5.5.9+dfsg-1ubuntu4.29+esm8
    • 5.5.9+dfsg-1ubuntu4.29+esm10
    • 5.5.9+dfsg-1ubuntu4.29+esm11
    • 5.5.9+dfsg-1ubuntu4.29+esm12
    • 5.5.9+dfsg-1ubuntu4.29+esm13
    • 5.5.9+dfsg-1ubuntu4.29+esm14
    • 5.5.9+dfsg-1ubuntu4.29+esm15
    • 5.5.9+dfsg-1ubuntu4.29+esm16
    • 5.5.9+dfsg-1ubuntu4.29+esm17
    • 5.5.9+dfsg-1ubuntu4.29+esm18
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php7.0 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.0.1-5
    • 7.0.1-6
    • 7.0.2-1
    • 7.0.2-3
    • 7.0.2-4
    • 7.0.2-5
    • 7.0.3-2
    • 7.0.3-3
    • 7.0.3-9ubuntu1
    • 7.0.4-5ubuntu1
    • 7.0.4-5ubuntu2
    • 7.0.4-7ubuntu1
    • 7.0.4-7ubuntu2
    • 7.0.4-7ubuntu2.1
    • 7.0.8-0ubuntu0.16.04.1
    • 7.0.8-0ubuntu0.16.04.2
    • 7.0.8-0ubuntu0.16.04.3
    • 7.0.13-0ubuntu0.16.04.1
    • 7.0.15-0ubuntu0.16.04.1
    • 7.0.15-0ubuntu0.16.04.2
    • 7.0.15-0ubuntu0.16.04.4
    • 7.0.18-0ubuntu0.16.04.1
    • 7.0.22-0ubuntu0.16.04.1
    • 7.0.25-0ubuntu0.16.04.1
    • 7.0.28-0ubuntu0.16.04.1
    • 7.0.30-0ubuntu0.16.04.1
    • 7.0.32-0ubuntu0.16.04.1
    • 7.0.33-0ubuntu0.16.04.1
    • 7.0.33-0ubuntu0.16.04.2
    • 7.0.33-0ubuntu0.16.04.3
    • 7.0.33-0ubuntu0.16.04.4
    • 7.0.33-0ubuntu0.16.04.5
    • 7.0.33-0ubuntu0.16.04.6
    • 7.0.33-0ubuntu0.16.04.7
    • 7.0.33-0ubuntu0.16.04.9
    • 7.0.33-0ubuntu0.16.04.11
    • 7.0.33-0ubuntu0.16.04.12
    • 7.0.33-0ubuntu0.16.04.14
    • 7.0.33-0ubuntu0.16.04.15
    • 7.0.33-0ubuntu0.16.04.16
    • 7.0.33-0ubuntu0.16.04.16+esm1
    • 7.0.33-0ubuntu0.16.04.16+esm2
    • 7.0.33-0ubuntu0.16.04.16+esm3
    • 7.0.33-0ubuntu0.16.04.16+esm4
    • 7.0.33-0ubuntu0.16.04.16+esm5
    • 7.0.33-0ubuntu0.16.04.16+esm6
    • 7.0.33-0ubuntu0.16.04.16+esm7
    • 7.0.33-0ubuntu0.16.04.16+esm8
    • 7.0.33-0ubuntu0.16.04.16+esm9
    • 7.0.33-0ubuntu0.16.04.16+esm10
    • 7.0.33-0ubuntu0.16.04.16+esm11
    • 7.0.33-0ubuntu0.16.04.16+esm12
    • 7.0.33-0ubuntu0.16.04.16+esm13
    • 7.0.33-0ubuntu0.16.04.16+esm14
    Affected ranges
    • ECOSYSTEM: < 7.0.33-0ubuntu0.16.04.16+esm15

    Update to 7.0.33-0ubuntu0.16.04.16+esm15

  • php7.2 Ubuntu:Pro:18.04:LTS

    Versions
    • 7.2.1-1ubuntu2
    • 7.2.2-1ubuntu1
    • 7.2.2-1ubuntu2
    • 7.2.3-1ubuntu1
    • 7.2.5-0ubuntu0.18.04.1
    • 7.2.7-0ubuntu0.18.04.1
    • 7.2.7-0ubuntu0.18.04.2
    • 7.2.10-0ubuntu0.18.04.1
    • 7.2.15-0ubuntu0.18.04.1
    • 7.2.15-0ubuntu0.18.04.2
    • 7.2.17-0ubuntu0.18.04.1
    • 7.2.19-0ubuntu0.18.04.1
    • 7.2.19-0ubuntu0.18.04.2
    • 7.2.24-0ubuntu0.18.04.1
    • 7.2.24-0ubuntu0.18.04.2
    • 7.2.24-0ubuntu0.18.04.3
    • 7.2.24-0ubuntu0.18.04.4
    • 7.2.24-0ubuntu0.18.04.6
    • 7.2.24-0ubuntu0.18.04.7
    • 7.2.24-0ubuntu0.18.04.8
    • 7.2.24-0ubuntu0.18.04.9
    • 7.2.24-0ubuntu0.18.04.10
    • 7.2.24-0ubuntu0.18.04.11
    • 7.2.24-0ubuntu0.18.04.12
    • 7.2.24-0ubuntu0.18.04.13
    • 7.2.24-0ubuntu0.18.04.15
    • 7.2.24-0ubuntu0.18.04.16
    • 7.2.24-0ubuntu0.18.04.17
    • 7.2.24-0ubuntu0.18.04.17+esm1
    • 7.2.24-0ubuntu0.18.04.17+esm2
    • 7.2.24-0ubuntu0.18.04.17+esm3
    • 7.2.24-0ubuntu0.18.04.17+esm4
    • 7.2.24-0ubuntu0.18.04.17+esm5
    • 7.2.24-0ubuntu0.18.04.17+esm6
    • 7.2.24-0ubuntu0.18.04.17+esm7
    Affected ranges
    • ECOSYSTEM: < 7.2.24-0ubuntu0.18.04.17+esm8

    Update to 7.2.24-0ubuntu0.18.04.17+esm8

  • php7.4 Ubuntu:20.04:LTS

    Versions
    • 7.4.3-4build1
    • 7.4.3-4build2
    • 7.4.3-4ubuntu1
    • 7.4.3-4ubuntu1.1
    • 7.4.3-4ubuntu2.2
    • 7.4.3-4ubuntu2.4
    • 7.4.3-4ubuntu2.5
    • 7.4.3-4ubuntu2.6
    • 7.4.3-4ubuntu2.7
    • 7.4.3-4ubuntu2.8
    • 7.4.3-4ubuntu2.9
    • 7.4.3-4ubuntu2.10
    • 7.4.3-4ubuntu2.11
    • 7.4.3-4ubuntu2.12
    • 7.4.3-4ubuntu2.13
    • 7.4.3-4ubuntu2.15
    • 7.4.3-4ubuntu2.16
    • 7.4.3-4ubuntu2.17
    • 7.4.3-4ubuntu2.18
    • 7.4.3-4ubuntu2.19
    • 7.4.3-4ubuntu2.20
    • 7.4.3-4ubuntu2.22
    • 7.4.3-4ubuntu2.23
    • 7.4.3-4ubuntu2.24
    • 7.4.3-4ubuntu2.26
    • 7.4.3-4ubuntu2.28
    Affected ranges
    • ECOSYSTEM: < 7.4.3-4ubuntu2.29

    Update to 7.4.3-4ubuntu2.29

  • php8.1 Ubuntu:22.04:LTS

    Versions
    • 8.1.0~rc4-1ubuntu2
    • 8.1.0-1
    • 8.1.2-1ubuntu1
    • 8.1.2-1ubuntu2
    • 8.1.2-1ubuntu2.1
    • 8.1.2-1ubuntu2.2
    • 8.1.2-1ubuntu2.3
    • 8.1.2-1ubuntu2.4
    • 8.1.2-1ubuntu2.5
    • 8.1.2-1ubuntu2.6
    • 8.1.2-1ubuntu2.8
    • 8.1.2-1ubuntu2.9
    • 8.1.2-1ubuntu2.10
    • 8.1.2-1ubuntu2.11
    • 8.1.2-1ubuntu2.13
    • 8.1.2-1ubuntu2.14
    • 8.1.2-1ubuntu2.15
    • 8.1.2-1ubuntu2.17
    • 8.1.2-1ubuntu2.18
    • 8.1.2-1ubuntu2.19
    • 8.1.2-1ubuntu2.20
    Affected ranges
    • ECOSYSTEM: < 8.1.2-1ubuntu2.21

    Update to 8.1.2-1ubuntu2.21

  • php8.3 Ubuntu:24.04:LTS

    Versions
    • 8.3.0-1
    • 8.3.0-1ubuntu1
    • 8.3.4-1
    • 8.3.4-1build1
    • 8.3.6-0maysync1
    • 8.3.6-0ubuntu0.24.04.1
    • 8.3.6-0ubuntu0.24.04.2
    • 8.3.6-0ubuntu0.24.04.3
    Affected ranges
    • ECOSYSTEM: < 8.3.6-0ubuntu0.24.04.4

    Update to 8.3.6-0ubuntu0.24.04.4

Original sources

Check your server →