CVE-2025-1734

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when receiving headers from an HTTP server, headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

Risk Assessment

The application may accept invalid HTTP headers, potentially leading to unexpected behavior or request smuggling attacks.

Recommendation

Upgrade PHP to version 8.1.32, 8.2.28, 8.3.19, 8.4.5 or later.

Original NVD description (English source)

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.