CVE-2025-1734

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its HTTP stream wrapper lets functions such as file_get_contents() and fopen() read http:// and https:// URLs, and exposes the response headers to the script in $http_response_header.

An Improper Input Validation vulnerability (CVE-2025-1734) has been identified in the response header parsing of PHP's HTTP stream wrapper, which allows a server an attacker controls or can impersonate to get malformed header lines, such as lines without a colon, accepted as valid headers, which may confuse applications that act on the response headers. PHP tracks this issue as GHSA-pcmh-g36c-qc44.

Per MITRE CWE-20: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

This issue affects PHP 8.1 before 8.1.32, PHP 8.2 before 8.2.28, PHP 8.3 before 8.3.19 and PHP 8.4 before 8.4.5, as well as all releases of the End-of-Life PHP 5.6 through 8.0 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard)
• Affected versions: <8.1.32, >=8.2.0 <8.2.28, >=8.3.0 <8.3.19, >=8.4.0 <8.4.5
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.1.32, 8.2.28, 8.3.19, 8.4.5
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the HTTP stream wrapper of PHP 8.1 before 8.1.32, 8.2 before 8.2.28, 8.3 before 8.3.19 and 8.4 before 8.4.5, and in the End-of-Life PHP 5.6 through 8.0 release lines, which never received the upstream fix. The PHP project scores it 6.3 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).

After the status line, the wrapper reads the response headers one line at a time, looks for the colon that separates the header name from its value, and acts on a few headers itself, such as Location and Transfer-Encoding. Every line is also added to $http_response_header. RFC 7230 requires a colon in every header line, but in PHP 7.4.33 a line without one was simply given an empty value:

http_header_value = memchr(http_header_line, ':', http_header_line_length);
if (http_header_value) {
    http_header_value++; /* Skip ':' */

    /* Strip leading whitespace */
    while (http_header_value < e
            && (*http_header_value == ' ' || *http_header_value == '\t')) {
        http_header_value++;
    }
} else {
    /* There is no colon. Set the value to the end of the header line, which is
     * effectively an empty string. */
    http_header_value = e;
}

Such a line was then stored in $http_response_header like any other header. Lines with whitespace inside the header name were accepted the same way. Code that parses $http_response_header itself, or other components that read the same response, may interpret those lines differently from PHP, so a malicious server can get a malformed line past checks that rely on the header list, for example to smuggle a header that a stricter parser would have rejected.

Exploitation needs allow_url_fopen enabled and an application that fetches a URL with the HTTP stream wrapper from a server the attacker controls, or can answer for through a redirect, a proxy or a plain-HTTP connection, and that acts on the response headers. Any SAPI is affected. Applications that only fetch from trusted servers over verified HTTPS, or that use another HTTP client such as cURL, are not exposed through this issue.

The fix, by Jakub Zelenka, treats a header line without a colon as an invalid response and fails the request; the NES releases also reject whitespace in the header name, as upstream does. The upstream code now reads:

} else {
    /* There is no colon which means invalid response so error. */
    header_info->error = true;
    php_stream_wrapper_log_error(wrapper, options,
            "HTTP invalid response format (no colon in header line)!");
    zend_string_efree(last_header_line_str);
    return NULL;
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4 and 8.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, fetch remote resources only from trusted servers over HTTPS with certificate verification, or disable allow_url_fopen where remote URL access is not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.1.32, 8.2.28, 8.3.19, 8.4.5, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Jakub Zelenka (finder, remediation)