CVE-2025-1736

moderate-risk
Published 2025-03-30

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

Do I need to act?

-
0.65% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10 High
NETWORK / LOW complexity

Affected Products (2)

Php

Affected Vendors

Php Netapp

References (3)

Vendor Advisory https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528
https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20250523-0006/
35
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 2/34 · Minimal
Exposure 7/34 · Low