vulnerability
Ubuntu: (Multiple Advisories) (CVE-2025-1861): PHP vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Mar 30, 2025 | Apr 1, 2025 | Aug 18, 2025 |
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Mar 30, 2025
Added
Apr 1, 2025
Modified
Aug 18, 2025
Description
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Solutions
ubuntu-pro-upgrade-libapache2-mod-php7-0ubuntu-pro-upgrade-libapache2-mod-php7-2ubuntu-pro-upgrade-libapache2-mod-php7-4ubuntu-pro-upgrade-libapache2-mod-php8-0ubuntu-pro-upgrade-libapache2-mod-php8-1ubuntu-pro-upgrade-libapache2-mod-php8-3ubuntu-pro-upgrade-libphp7-0-embedubuntu-pro-upgrade-libphp7-2-embedubuntu-pro-upgrade-php7-0-cgiubuntu-pro-upgrade-php7-0-cliubuntu-pro-upgrade-php7-0-fpmubuntu-pro-upgrade-php7-2-cgiubuntu-pro-upgrade-php7-2-cliubuntu-pro-upgrade-php7-2-fpmubuntu-pro-upgrade-php7-4ubuntu-pro-upgrade-php7-4-cgiubuntu-pro-upgrade-php7-4-cliubuntu-pro-upgrade-php7-4-fpmubuntu-pro-upgrade-php8-1ubuntu-pro-upgrade-php8-1-cgiubuntu-pro-upgrade-php8-1-cliubuntu-pro-upgrade-php8-1-fpmubuntu-pro-upgrade-php8-3ubuntu-pro-upgrade-php8-3-cgiubuntu-pro-upgrade-php8-3-cliubuntu-pro-upgrade-php8-3-fpm
References
- CVE-2025-1861
- https://attackerkb.com/topics/CVE-2025-1861
- CWE-131
- UBUNTU-USN-7400-1
- UBUNTU-USN-7645-1
- URL-https://github.com/php/php-src/commit/ac1a054bb3eb5994a199e8b18cca28cbabf5943e
- URL-https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff
- URL-https://ubuntu.com/security/notices/USN-7400-1
- URL-https://www.cve.org/CVERecord?id=CVE-2025-1861
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.