CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Summary
Stream HTTP wrapper header check might omit basic auth header
Original description
The description as published by the source.
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-1736 php7.4 Fixed in: 7.4.33-1+deb11u8
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web lists.debian.org