CVE-2025-1217 Header parser of http stream wrapper does not handle folded headers
Attackers can exploit incorrect parsing of folded HTTP headers in PHP's stream wrapper to misinterpret responses, potentially bypassing security checks or accessing incorrect data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1217?
CVE-2025-1217 is a medium-severity vulnerability in Php Php, published on 29 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
Which versions are affected by CVE-2025-1217?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.32, 8.2.28, 8.3.19, 8.4.5 |
php Bitnami | All versions | 8.1.32, 8.2.28, 8.3.19, 8.4.5 |
php-min Bitnami | All versions | 8.1.32, 8.2.28, 8.3.19, 8.4.5 |
Products include Php Php.
How do I fix CVE-2025-1217?
Upgrade libphp to a fixed version for your release line: 8.1.32, 8.2.28, 8.3.19 or 8.4.5.
Is CVE-2025-1217 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1217 exists.
Other vulnerabilities in Php Php
Sources
Also known as AZL-59291, AZL-59294, BELL-CVE-2025-1217, BIT-libphp-2025-1217, BIT-php-2025-1217, BIT-php-min-2025-1217 and 8 more.