CVE-2025-1734CWE-20

Streams HTTP wrapper does not fail for headers with invalid name and no colon

Medium · published March 30, 2025

CVSS v4.0
6.3
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00492 · 41.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-30T05:43Z
EPSS history
Timeline
  • 30 MAR 05:43Z
    Streams HTTP wrapper does not fail for headers with invalid name and no colon
    cvelistv5