CVE-2025-1734

low-risk
Published 2025-03-30

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

Do I need to act?

-
0.38% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Php

Affected Vendors

Php Netapp

References (3)

Vendor Advisory https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44
https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20250523-0009/
29
/ 100
low-risk
Severity 21/34 · High
Exploitability 1/34 · Minimal
Exposure 7/34 · Low