Critical Vulnerability in PHP Packages: CVE-2025-1734
Summary
UBUNTU-CVE-2025-1734: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even tho... Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its flexibility, ease of use, and extensive community support. The affected packages include various versions of PHP (5.5, 7.0, 7.2, 7.4, 8.1, 8.3, and 8.4) that are integral for running dynamic web applications. This vulnerability allows invalid HTTP headers to be accepted, potentially leading to security issues in applications relying on PHP.
Vulnerability Detail
In PHP versions 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, and 8.4.* before 8.4.5, there exists a vulnerability where headers received from an HTTP server that are missing a colon (:) are incorrectly treated as valid headers. This flaw can mislead applications into accepting invalid headers, which may lead to unexpected behavior or security breaches, such as header injection attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the server-side to check for valid headers before processing them. This can help mitigate the risk of accepting invalid headers until the packages are updated.
Conclusion
The CVE-2025-1734 vulnerability poses a significant risk to applications using affected PHP versions by allowing invalid HTTP headers to be processed. It is essential to update to the latest patched versions of PHP to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for php5 →
FAQ
CVE-2025-1734 is a vulnerability in various PHP versions that allows invalid HTTP headers to be accepted, potentially leading to security issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential header injection attacks, which can lead to unauthorized access or manipulation of application behavior.
Yes, patched versions of the affected PHP packages are available. It is recommended to update to the latest versions to mitigate the vulnerability.
If immediate updates are not possible, implement server-side validation for HTTP headers as a temporary workaround to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
