Critical Security Vulnerability in PHP: Multiple Issues Addressed
Summary
RLSA-2025:7489: Important: php security update. Affects php versions < 0:8.3.19-1.el10_0. Fixed in 0:8.3.19-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language widely utilized for web development, particularly with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. However, recent vulnerabilities have been identified that could compromise the security of applications using PHP, particularly in version 8.3.19-1.el10_0 and earlier.
Vulnerability Detail
The vulnerabilities stem from various issues within the PHP HTTP stream wrapper, including improper handling of folded headers, potential omission of basic authentication headers, and failure to reject headers with invalid names. These flaws can lead to unauthorized access, data leakage, and application crashes. The vulnerabilities are tracked under CVEs: CVE-2024-11235, CVE-2025-1217, CVE-2025-1219, CVE-2025-1734, CVE-2025-1736, and CVE-2025-1861, with a CVSS score of 8.1 indicating a high severity level.
How To Fix
Minimum fixed version
0:8.3.19-1.el10_0
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected PHP applications or disable the HTTP stream wrapper functionality until the update is applied. Additionally, review and sanitize all HTTP headers being processed by your application to mitigate potential risks.
Conclusion
In summary, multiple critical vulnerabilities have been identified in PHP that could significantly impact web applications. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for php →
FAQ
The vulnerabilities can lead to unauthorized access, data leakage, and application crashes, potentially compromising sensitive user information.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider implementing workarounds such as restricting access to the affected applications and sanitizing HTTP headers.
The CVSS score of the vulnerabilities is 8.1, indicating a high severity level.
The vulnerabilities were identified by the Rocky Enterprise Software Foundation and Red Hat, who have provided the necessary patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
