In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-commonUpgrade php-opcacheUpgrade php-xmlUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-dbaUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-odbcUpgrade php-snmpUpgrade php-ffiUpgrade php-processUpgrade php-intlUpgrade php-cliUpgrade php-pgsqlUpgrade libzip-develUpgrade php-pearUpgrade php-pecl-xdebugUpgrade php-enchantUpgrade php-pdoUpgrade php-dbgUpgrade php-soapUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade libzipUpgrade php-pecl-xdebug3Upgrade php-develUpgrade php-fpmUpgrade apcu-panelUpgrade php-gmpUpgrade php-pecl-redis6Upgrade php-jsonUpgrade php-pecl-apcu-develUpgrade phpUpgrade php-gdUpgrade php-embeddedUpgrade php-bcmath | Apr 30, 2025 | Mar 30, 2025 |
| Alpine Linux | — | Upgrade php82Upgrade php83Upgrade php81 | Aug 8, 2025 | Mar 30, 2025 |
| Amazon Linux Ami 2 | — | Upgrade php-snmpUpgrade php-intlUpgrade php-bcmathUpgrade php-pspellUpgrade php-cliUpgrade php-embeddedUpgrade php-mysqlndUpgrade phpUpgrade php-gdUpgrade php-processUpgrade php-xmlUpgrade php-ldapUpgrade php-opcacheUpgrade php-enchantUpgrade php-commonUpgrade php-gmpUpgrade php-develUpgrade php-pgsqlUpgrade php-debuginfoUpgrade php-mbstringUpgrade php-fpmUpgrade php-pdoUpgrade php-dbgUpgrade php-soapUpgrade php-sodiumUpgrade php-odbcUpgrade php-dba | Apr 2, 2025 | Mar 30, 2025 |
| Amazon_linux_2023 | — | Upgrade php8.3-snmpUpgrade php8.2-embeddedUpgrade php8.2-pgsqlUpgrade php8.2-embedded-debuginfoUpgrade php8.2-xml-debuginfoUpgrade php8.1-commonUpgrade php8.1-develUpgrade php8.1-ffi-debuginfoUpgrade php8.3-commonUpgrade php8.3-debugsourceUpgrade php8.3-ffiUpgrade php8.3-gd-debuginfoUpgrade php8.1-pdoUpgrade php8.1-processUpgrade php8.1-pspellUpgrade php8.2-opcache-debuginfoUpgrade php8.3-gmpUpgrade php8.3-pdo-debuginfoUpgrade php8.2-soap-debuginfoUpgrade php8.1-gmpUpgrade php8.3-intl-debuginfoUpgrade php8.1-opcacheUpgrade php8.2-develUpgrade php8.2-pspell-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.1-ldap-debuginfoUpgrade php8.3-gmp-debuginfoUpgrade php8.2-pspellUpgrade php8.2-dba-debuginfoUpgrade php8.1Upgrade php8.3-dbaUpgrade php8.3-develUpgrade php8.2-opcacheUpgrade php8.2-sodium-debuginfoUpgrade php8.1-tidyUpgrade php8.2-snmpUpgrade php8.1-embedded-debuginfoUpgrade php8.3-tidyUpgrade php8.1-tidy-debuginfoUpgrade php8.3-fpmUpgrade php8.1-odbc-debuginfoUpgrade php8.2-ldap-debuginfoUpgrade php8.1-pdo-debuginfoUpgrade php8.3-common-debuginfoUpgrade php8.1-pgsqlUpgrade php8.2-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.2-tidy-debuginfoUpgrade php8.3-xml-debuginfoUpgrade php8.1-common-debuginfoUpgrade php8.3-enchantUpgrade php8.1-ldapUpgrade php8.2-zip-debuginfoUpgrade php8.3-processUpgrade php8.2-soapUpgrade php8.3-ldap-debuginfoUpgrade php8.3-dbg-debuginfoUpgrade php8.3-pdoUpgrade php8.1-cli-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.2-dbgUpgrade php8.2-enchantUpgrade php8.2-gmpUpgrade php8.1-zipUpgrade php8.2-gmp-debuginfoUpgrade php8.3-embeddedUpgrade php8.3Upgrade php8.3-dba-debuginfoUpgrade php8.2-intl-debuginfoUpgrade php8.3-enchant-debuginfoUpgrade php8.3-modphpUpgrade php8.1-bcmath-debuginfoUpgrade php8.3-process-debuginfoUpgrade php8.3-zip-debuginfoUpgrade php8.3-sodiumUpgrade php8.2-cli-debuginfoUpgrade php8.2-mbstringUpgrade php8.2-bcmathUpgrade php8.1-soap-debuginfoUpgrade php8.2-common-debuginfoUpgrade php8.3-ldapUpgrade php8.2-tidyUpgrade php8.1-process-debuginfoUpgrade php8.2-pdo-debuginfoUpgrade php8.3-bcmath-debuginfoUpgrade php8.2-snmp-debuginfoUpgrade php8.1-xmlUpgrade php8.3-opcache-debuginfoUpgrade php8.3-debuginfoUpgrade php8.2-fpmUpgrade php8.3-mbstring-debuginfoUpgrade php8.2-mysqlndUpgrade php8.1-enchant-debuginfoUpgrade php8.2-enchant-debuginfoUpgrade php8.1-fpmUpgrade php8.1-intl-debuginfoUpgrade php8.3-pspellUpgrade php8.1-cliUpgrade php8.2-ffiUpgrade php8.1-gdUpgrade php8.1-enchantUpgrade php8.1-debugsourceUpgrade php8.1-dbgUpgrade php8.3-tidy-debuginfoUpgrade php8.3-sodium-debuginfoUpgrade php8.3-odbc-debuginfoUpgrade php8.3-mysqlndUpgrade php8.3-gdUpgrade php8.3-fpm-debuginfoUpgrade php8.3-embedded-debuginfoUpgrade php8.2-zipUpgrade php8.2-gd-debuginfoUpgrade php8.1-ffiUpgrade php8.3-soap-debuginfoUpgrade php8.1-dbg-debuginfoUpgrade php8.2-sodiumUpgrade php8.2-ffi-debuginfoUpgrade php8.2-commonUpgrade php8.1-mysqlnd-debuginfoUpgrade php8.1-mysqlndUpgrade php8.3-zipUpgrade php8.3-pgsqlUpgrade php8.3-opcacheUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.3-mbstringUpgrade php8.2-ldapUpgrade php8.1-embeddedUpgrade php8.2-xmlUpgrade php8.3-cli-debuginfoUpgrade php8.2-odbcUpgrade php8.1-snmpUpgrade php8.1-zip-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.1-mbstringUpgrade php8.1-gd-debuginfoUpgrade php8.2-dbaUpgrade php8.3-xmlUpgrade php8.1-snmp-debuginfoUpgrade php8.1-pgsql-debuginfoUpgrade php8.1-opcache-debuginfoUpgrade php8.2-fpm-debuginfoUpgrade php8.3-odbcUpgrade php8.3-ffi-debuginfoUpgrade php8.3-bcmathUpgrade php8.2-odbc-debuginfoUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-gdUpgrade php8.1-pspell-debuginfoUpgrade php8.1-gmp-debuginfoUpgrade php8.1-debuginfoUpgrade php8.1-bcmathUpgrade php8.3-pspell-debuginfoUpgrade php8.3-soapUpgrade php8.3-snmp-debuginfoUpgrade php8.3-dbgUpgrade php8.2-processUpgrade php8.2-pdoUpgrade php8.1-soapUpgrade php8.3-pgsql-debuginfoUpgrade php8.3-intlUpgrade php8.1-xml-debuginfoUpgrade php8.1-intlUpgrade php8.2-intlUpgrade php8.2Upgrade php8.1-mbstring-debuginfoUpgrade php8.1-dbaUpgrade php8.1-odbcUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.1-dba-debuginfoUpgrade php8.2-debugsourceUpgrade php8.2-cliUpgrade php8.1-fpm-debuginfoUpgrade php8.3-cli | Apr 3, 2025 | Mar 30, 2025 |
| Debian | — | Upgrade php8.2Upgrade php7.4Upgrade php8.4 | Mar 17, 2025 | Mar 17, 2025 |
| Freebsd | — | Upgrade php83Upgrade php84Upgrade php82Upgrade php81 | Dec 10, 2025 | Mar 13, 2025 |
| Oracle_linux | — | Upgrade php-snmpUpgrade phpUpgrade php-pecl-xdebugUpgrade php-xmlUpgrade php-cliUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-ldapUpgrade php-pearUpgrade php-pecl-redis6Upgrade php-fpmUpgrade php-bcmathUpgrade php-commonUpgrade php-odbcUpgrade php-dbgUpgrade php-pecl-xdebug3Upgrade php-opcacheUpgrade libzip-develUpgrade php-develUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade php-intlUpgrade libzip-toolsUpgrade php-ffiUpgrade php-xmlrpcUpgrade libzipUpgrade php-enchantUpgrade apcu-panelUpgrade php-mbstringUpgrade php-soapUpgrade php-dbaUpgrade php-gmpUpgrade php-pdoUpgrade php-gdUpgrade php-embeddedUpgrade php-processUpgrade php-pgsql | Apr 30, 2025 | Mar 30, 2025 |
| Php | — | Upgrade to PHP version 8.4.5Upgrade to PHP version 8.2.26Upgrade to PHP version 8.3.14Upgrade to PHP version 8.1.31 | Feb 17, 2026 | Feb 17, 2026 |
| Redhat_linux | — | Upgrade php-pecl-redis6Upgrade libzipUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-toolsUpgrade php-xmlUpgrade php-ffiUpgrade php-embedded-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-snmpUpgrade php-pecl-apcuUpgrade php-enchant-debuginfoUpgrade php-ffi-debuginfoUpgrade apcu-panelUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-mysqlndUpgrade php-pecl-apcu-debugsourceUpgrade php-processUpgrade libzip-develUpgrade php-xmlrpc-debuginfoUpgrade php-soap-debuginfoUpgrade php-pdoUpgrade phpUpgrade php-enchantUpgrade php-gmp-debuginfoUpgrade php-ldapUpgrade php-embeddedUpgrade php-gdUpgrade php-fpm-debuginfoUpgrade php-pecl-zipUpgrade php-intlUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-opcacheUpgrade php-pecl-redis6-debugsourceUpgrade php-cliUpgrade php-pecl-rrdUpgrade php-process-debuginfoUpgrade libzip-debugsourceUpgrade php-common-debuginfoUpgrade php-dbgUpgrade php-dbaUpgrade php-dba-debuginfoUpgrade php-odbc-debuginfoNo solution existsUpgrade php-commonUpgrade php-odbcUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade php-pearUpgrade php-pecl-redis6-debuginfoUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-json-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-fpmUpgrade php-soapUpgrade php-mysqlnd-debuginfoUpgrade php-gmpUpgrade php-opcache-debuginfoUpgrade php-cli-debuginfoUpgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-jsonUpgrade php-xml-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-xdebug3-debugsourceUpgrade php-intl-debuginfoUpgrade php-pecl-xdebug3Upgrade php-mbstringUpgrade php-snmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-dbg-debuginfo | Apr 30, 2025 | Mar 30, 2025 |
| Rocky_linux | — | Upgrade php-gdUpgrade php-embedded-debuginfoUpgrade php-odbc-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-redis6Upgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-pecl-xdebug3-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-ldapUpgrade php-pecl-apcu-debugsourceUpgrade php-enchantUpgrade php-bcmathUpgrade php-pecl-zip-debugsourceUpgrade php-embeddedUpgrade php-gmp-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-develUpgrade php-soapUpgrade php-pdo-debuginfoUpgrade libzip-debugsourceUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-dbaUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebug3-debugsourceUpgrade php-cli-debuginfoUpgrade php-pgsqlUpgrade php-fpmUpgrade phpUpgrade php-ffi-debuginfoUpgrade php-gmpUpgrade php-pdoUpgrade libzipUpgrade php-debugsourceUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-pecl-zipUpgrade php-pecl-redis6-debugsourceUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-cliUpgrade php-opcacheUpgrade php-pecl-redis6-debuginfoUpgrade php-ldap-debuginfoUpgrade php-intlUpgrade libzip-develUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-ffiUpgrade libzip-toolsUpgrade php-soap-debuginfoUpgrade php-odbcUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-process-debuginfoUpgrade php-processUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-opcache-debuginfoUpgrade php-snmpUpgrade php-mbstring-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-bcmath-debuginfoUpgrade libzip-debuginfoUpgrade php-mysqlndUpgrade php-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-rrdUpgrade php-json-debuginfoUpgrade php-common-debuginfoUpgrade php-dba-debuginfoUpgrade php-common | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade php7-opensslUpgrade php7-pharUpgrade php7-ctypeUpgrade php7-enchantUpgrade php8-readlineUpgrade php8-sysvshmUpgrade php7-ldapUpgrade php7-posixUpgrade php7-shmopUpgrade php7-soapUpgrade php7-sysvsemUpgrade php7-jsonUpgrade php7-odbcUpgrade php8-sysvsemUpgrade php8-fpmUpgrade php7-mbstringUpgrade php8-fileinfoUpgrade php8-fastcgiUpgrade php8-sodiumUpgrade php7-fpmUpgrade php7-develUpgrade apache2-mod_php7Upgrade php7-ftpUpgrade php8-ftpUpgrade php8-pgsqlUpgrade php7-iconvUpgrade php7-exifUpgrade php7-bcmathUpgrade php8-exifUpgrade php7-gettextUpgrade php7-zlibUpgrade php7-sysvmsgUpgrade php8-sqliteUpgrade php8-pharUpgrade php7-dbaUpgrade php8-xmlreaderUpgrade php7-pgsqlUpgrade php7-snmpUpgrade php7-tokenizerUpgrade php8-shmopUpgrade php8-gettextUpgrade php8-gmpUpgrade php8-iconvUpgrade php8-bcmathUpgrade php7-fastcgiUpgrade php7-pcntlUpgrade php8-mbstringUpgrade php8-pcntlUpgrade php8-enchantUpgrade apache2-mod_php8Upgrade php7-embedUpgrade php7-xmlwriterUpgrade php7-readlineUpgrade php7-pdoUpgrade php7-tidyUpgrade php8-ffiUpgrade php7-fileinfoUpgrade php7-bz2Upgrade php8-embedUpgrade php8-ldapUpgrade php7-zipUpgrade php7-sodiumUpgrade php7-socketsUpgrade php8-xslUpgrade php8-domUpgrade php8-cliUpgrade php7-gdUpgrade php8-posixUpgrade php7-sysvshmUpgrade php7-xslUpgrade php8-odbcUpgrade php8-fpm-apacheUpgrade php7Upgrade php7-domUpgrade php8-intlUpgrade php7-xmlrpcUpgrade php8-tokenizerUpgrade php8-gdUpgrade php7-intlUpgrade php7-curlUpgrade php8-ctypeUpgrade php7-sqliteUpgrade php7-mysqlUpgrade php7-calendarUpgrade php8-opcacheUpgrade php8-socketsUpgrade php8-sysvmsgUpgrade php8-develUpgrade php8Upgrade php7-testUpgrade php8-mysqlUpgrade php8-curlUpgrade php7-xmlreaderUpgrade php8-zlibUpgrade php8-tidyUpgrade php8-snmpUpgrade php8-opensslUpgrade php7-opcacheUpgrade php8-calendarUpgrade php7-cliUpgrade php8-bz2Upgrade php8-xmlwriterUpgrade php8-testUpgrade php8-soapUpgrade php8-pdoUpgrade php8-zipUpgrade php7-gmpUpgrade php8-dba | Mar 25, 2025 | Mar 24, 2025 |
| Ubuntu | — | Upgrade php7.0-cli (Ubuntu Pro)Upgrade libapache2-mod-php8.3Upgrade php8.1-cgiUpgrade php8.3-cgiUpgrade php7.2-cli (Ubuntu Pro)Upgrade php7.2-cgi (Ubuntu Pro)Upgrade php7.0-cgi (Ubuntu Pro)Upgrade php8.3-cliUpgrade libapache2-mod-php7.0 (Ubuntu Pro)Upgrade php8.1-cliUpgrade php7.0-fpm (Ubuntu Pro)Upgrade php7.4-cliUpgrade php7.4-cgiUpgrade libapache2-mod-php7.2 (Ubuntu Pro)Upgrade libphp7.0-embed (Ubuntu Pro)Upgrade php7.4Upgrade php8.3-fpmUpgrade php8.3Upgrade libapache2-mod-php7.4Upgrade libapache2-mod-php8.1Upgrade libphp7.2-embed (Ubuntu Pro)Upgrade php8.1-fpmUpgrade php7.2-fpm (Ubuntu Pro)Upgrade php7.4-fpmUpgrade libapache2-mod-php8.0Upgrade php8.1 | Apr 1, 2025 | Mar 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub