CVE-2024-11234

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, when using streams with a configured proxy and the request_fulluri option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to perform arbitrary HTTP requests through the proxy.

Risk Assessment

An attacker could exploit this vulnerability to perform HTTP request smuggling attacks, potentially leading to data integrity breaches or privilege escalation.

Recommendation

It is recommended to upgrade PHP to versions 8.1.31, 8.2.26, 8.3.14 or later.

Original NVD description (English source)

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests