CVE-2025-1736
MediumSummary
In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when user-supplied headers are sent, insufficient validation of end-of-line characters may prevent certain headers from being sent or lead to certain headers being misinterpreted.
Risk Assessment
An attacker could manipulate HTTP headers, potentially leading to header injection attacks or bypassing security controls.
Recommendation
Upgrade PHP to version 8.1.32, 8.2.28, 8.3.19, 8.4.5 or later.
Original NVD description (English source)
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.