CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon

What is CVE-2025-1734?

CVE-2025-1734 is a medium-severity vulnerability in Php Php, published on 30 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

Weakness: CWE-20

Which versions are affected by CVE-2025-1734?

3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.

Products include Netapp Ontap, Php Php.

How do I fix CVE-2025-1734?

Upgrade libphp to a fixed version for your release line: 8.1.32, 8.2.28, 8.3.19 or 8.4.5.

Is CVE-2025-1734 being exploited?

There is no known exploitation of CVE-2025-1734 in the wild and no public exploit code.

Other vulnerabilities in Php Php

• CVE-2024-8932 OOB access in ldap_escape Critical 9.8
• CVE-2026-22049 Auth bypass in ONTAP 9 High 8.7
• CVE-2026-22050 Business logic in ONTAP 9 Medium 6.9
• CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header Medium 6.3
• CVE-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes Medium 6.3

All Php Php vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-59315, AZL-59334, BELL-CVE-2025-1734, BIT-libphp-2025-1734, BIT-php-2025-1734, BIT-php-min-2025-1734 and 9 more.