Critical Security Update for PHP: Important Vulnerabilities Addressed
Summary
ALSA-2025:7489: Important: php security update. Affects php versions < 8.3.19-1.el10_0. Fixed in 8.3.19-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is especially known for its ability to embed into HTML, making it a popular choice for server-side scripting. The recent vulnerabilities identified in PHP could potentially expose applications to various security threats, including unauthorized access and data manipulation.
Vulnerability Detail
The vulnerabilities in PHP stem from issues in the HTTP stream wrapper's header parser, which fails to properly handle folded headers (CVE-2025-1217) and may omit basic authentication headers (CVE-2025-1736). Additionally, the stream wrapper does not correctly fail for headers with invalid names and no colon (CVE-2025-1734), and it uses incorrect content-type headers when requesting redirected resources (CVE-2025-1219). Other issues include truncation of redirect locations to 1024 bytes (CVE-2025-1861) and a use-after-free vulnerability in the reference counting during request shutdown (CVE-2024-11235). These vulnerabilities can lead to unauthorized access, data leakage, and application crashes.
How To Fix
Minimum fixed version
8.3.19-1.el10_0
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict input validation and sanitization on all HTTP headers processed by your application to mitigate potential exploitation of these vulnerabilities.
Conclusion
The identified vulnerabilities in PHP pose significant security risks that can affect web applications. It is crucial to update to the latest patched version to safeguard against potential exploits. Implementing best practices in input validation can also help mitigate risks until updates can be applied.
See every vulnerability recorded for php →
FAQ
These vulnerabilities can lead to unauthorized access, data leakage, and potential application crashes, compromising the security and integrity of your application.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, you can receive real-time alerts.
While updating is the best solution, you can implement strict input validation and sanitization on HTTP headers as a temporary workaround.
If immediate updates are not possible, ensure that your application is configured to handle invalid headers gracefully and monitor for any unusual activity.
For detailed information, refer to the CVE pages associated with each vulnerability, which provide insights into their impact and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for php.
