Critical PHP Vulnerability in Multiple Versions: CVE-2025-1220
Summary
UBUNTU-CVE-2025-1220: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use and flexibility, allowing developers to create dynamic web pages and applications. The impacted versions of PHP include 5.5.9, 7.0.33, 7.2.24, 7.4.3, 8.1.2, 8.3.6, and 8.4.5. This vulnerability arises from insufficient validation of hostnames in certain functions, which can lead to security issues if not addressed.
Vulnerability Detail
In PHP versions 8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, and 8.4.* before 8.4.10, functions like fsockopen() do not properly validate that the hostname supplied does not contain null characters. This oversight can allow other functions, such as parse_url(), to treat the hostname differently, potentially leading to security vulnerabilities if user code implements access checks based on these functions. The CVSS score for this vulnerability is 3.7, indicating a low severity but still a significant risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks in your code to ensure that hostnames do not contain null characters before passing them to functions like fsockopen() or parse_url(). For example, you can use the following code snippet:
if (strpos($hostname, '\0') === false) {
// Safe to use the hostname
} else {
// Handle the error
}
Conclusion
The CVE-2025-1220 vulnerability in PHP highlights the importance of proper validation in programming. It is crucial for developers to update their PHP versions to the patched releases to mitigate potential security risks. Additionally, implementing validation checks can serve as a temporary measure until updates can be applied.
See every vulnerability recorded for php5 →
FAQ
CVE-2025-1220 is a vulnerability in multiple versions of PHP that arises from insufficient validation of hostnames in certain functions, potentially leading to security issues.
The affected PHP versions include 5.5.9, 7.0.33, 7.2.24, 7.4.3, 8.1.2, 8.3.6, and 8.4.5.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement additional validation checks in your code to prevent null characters in hostnames.
The CVSS score for this vulnerability is 3.7, indicating a low severity but still a notable risk.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
