CVE-2025-1220
Null byte termination in hostnames
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
It was discovered that PHP incorrectly handled certain hostnames containing null characters. A remote attacker could possibly use this issue to bypass certain hostname validation checks. It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql escaping functions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. It was discovered that PHP incorrectly handled parsing certain XML data in SOAP extensions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2025-02-11 CVE Reserved
- 2025-07-12 CVE Published
- 2025-07-14 CVE Updated
- 2025-07-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (1)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.1.0 < 8.1.33 Search vendor "PHP Group" for product "PHP" and version " >= 8.1.0 < 8.1.33" | en |
Affected
| ||||||
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.2.0 < 8.2.29 Search vendor "PHP Group" for product "PHP" and version " >= 8.2.0 < 8.2.29" | en |
Affected
| ||||||
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.3.0 < 8.3.23 Search vendor "PHP Group" for product "PHP" and version " >= 8.3.0 < 8.3.23" | en |
Affected
| ||||||
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.4.0 < 8.4.10 Search vendor "PHP Group" for product "PHP" and version " >= 8.4.0 < 8.4.10" | en |
Affected
| ||||||