// For flags

CVE-2025-1734

Streams HTTP wrapper does not fail for headers with invalid name and no colon

Severity Score

6.3
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

A flaw was found in PHP. This vulnerability allows applications to accept invalid headers via malformed HTTP headers missing a colon (:), which may confuse applications into processing them as valid headers.

It was discovered that PHP incorrectly handle certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. It was discovered that PHP incorrectly handle certain folded headers. An attacker could possibly use this issue to cause a crash or execute arbitrary code. It was discovered that PHP incorrectly handled certain headers. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS Ubuntu 24.10, and Ubuntu 24.04 LTS.

*Credits: Jakub Zelenka
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
Low
None
Integrity
None
None
Availability
None
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2025-02-27 CVE Reserved
  • 2025-03-17 CVE Published
  • 2025-04-01 CVE Updated
  • 2025-05-05 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
  • CAPEC-273: HTTP Response Smuggling
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
PHP Group
Search vendor "PHP Group"
 PHP
Search vendor "PHP Group" for product "PHP"
 >= 8.1.0 < 8.1.32
Search vendor "PHP Group" for product "PHP" and version " >= 8.1.0 < 8.1.32"
en
Affected
PHP Group
Search vendor "PHP Group"
 PHP
Search vendor "PHP Group" for product "PHP"
 >= 8.2.0 < 8.2.28
Search vendor "PHP Group" for product "PHP" and version " >= 8.2.0 < 8.2.28"
en
Affected
PHP Group
Search vendor "PHP Group"
 PHP
Search vendor "PHP Group" for product "PHP"
 >= 8.3.0 < 8.3.19
Search vendor "PHP Group" for product "PHP" and version " >= 8.3.0 < 8.3.19"
en
Affected
PHP Group
Search vendor "PHP Group"
 PHP
Search vendor "PHP Group" for product "PHP"
 >= 8.4.0 < 8.4.5
Search vendor "PHP Group" for product "PHP" and version " >= 8.4.0 < 8.4.5"
en
Affected