CVE-2025-1861
Critical
Description
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Php
PublishedMar 30, 2025
First seenMar 30, 2025
Weakness typeCWE-131CWE-131
How to fix
Update
- php php8.1.31, 8.2.26, 8.3.14, 8.4.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 8.1.0 ≤ v < 8.1.31, 8.2.0 ≤ v < 8.2.26, 8.3.0 ≤ v < 8.3.14, 8.4.0 ≤ v < 8.4.5 | 8.1.31, 8.2.26, 8.3.14, 8.4.5 |
| netapp ontap | 9 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.