CVE-2025-1217

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its http:// stream wrapper lets functions such as file_get_contents() and fopen() fetch URLs over HTTP and HTTPS, and exposes the response headers to the script.

An Improper Input Validation vulnerability (CVE-2025-1217) has been identified in the response header parser of PHP's HTTP stream wrapper, which allows a server that an attacker controls, or can impersonate, to make PHP misread the response headers by sending a folded header, so that an application can act on the wrong MIME type, Location or other header. PHP tracks this issue as GHSA-v8xr-gpvj-cx9g.

Per MITRE CWE-20: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

This issue affects all versions of PHP before 8.1.32, PHP 8.2 before 8.2.28, PHP 8.3 before 8.3.19 and PHP 8.4 before 8.4.5, which includes every End-of-Life release line from PHP 5.6 through 8.0, each up to its final release.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <8.1.32, >=8.2.0 <8.2.28, >=8.3.0 <8.3.19, >=8.4.0 <8.4.5
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.1.32, 8.2.28, 8.3.19, 8.4.5
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the HTTP stream wrapper of all PHP versions before 8.1.32, 8.2 before 8.2.28, 8.3 before 8.3.19 and 8.4 before 8.4.5, including every End-of-Life release line from PHP 5.6 through 8.0, which never received the upstream fix. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A).

HTTP allows a header value to continue on the next line when that line starts with a space or a tab, which is called line folding. RFC 9112 marks it as obsolete and requires user agents to replace the fold with whitespace before interpreting the value. PHP's HTTP stream wrapper read the response one line at a time and treated every line as the start of a new header, so a folded continuation became a separate, bogus entry and its text was lost from the header it belonged to.

The advisory describes two effects. A stream notifier can receive the wrong MIME type when Content-Type is folded, for example without the charset parameter that sits on the continuation line. The $http_response_header array also contains the continuation lines as sent, so application code that reads it can misparse the headers, for example picking the wrong headers for the final response after a redirect. HeroDevs' analysis notes that an application can likewise act on the wrong Location or other header.

Exploitation needs an application that fetches an http:// or https:// URL with the stream wrapper, with allow_url_fopen on, from a server that an attacker controls, or can answer for (for example over plain HTTP, or through a redirect or proxy on the way), and that acts on the response headers. The attacker can then influence how the response is interpreted; the PHP project's score reflects a limited impact. Applications that fetch URLs with other clients, such as the curl extension, or only from trusted servers over HTTPS, are not exposed through this issue.

The fix adds folding support to the header parser: continuation lines are joined to the previous header with a single space, header values are trimmed, and a folded line that appears before the first header makes the request fail. On PHP 7.4, HeroDevs' analysis notes that a header line starting with a carriage return also fails the request. On PHP 7.2, the fix builds on the earlier fix for unbounded header lines (php-src bug #78719), which the NES release also carries.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4 and 8.0 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.1.32, 8.2.28, 8.3.19, 8.4.5, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Tim Düsterhus (finder)
• Jakub Zelenka (remediation)