CVE-2025-1735 pgsql extension does not check for errors during escaping
The PHP pgsql extension fails to check for errors during string escaping, potentially causing application crashes when the Postgres server rejects invalid strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1735?
CVE-2025-1735 is a medium-severity vulnerability in Php Php, published on 13 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
Which versions are affected by CVE-2025-1735?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.33, 8.2.29, 8.3.23, 8.4.10 |
php Bitnami | All versions | 8.1.33, 8.2.29, 8.3.23, 8.4.10 |
php-min Bitnami | All versions | 8.1.33, 8.2.29, 8.3.23, 8.4.10 |
Products include Php Php.
How do I fix CVE-2025-1735?
Upgrade libphp to a fixed version for your release line: 8.1.33, 8.2.29, 8.3.23 or 8.4.10.
Is CVE-2025-1735 being exploited?
There is no known exploitation of CVE-2025-1735 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as AZL-65121, AZL-65124, BELL-CVE-2025-1735, BIT-libphp-2025-1735, BIT-php-2025-1735, BIT-php-min-2025-1735 and 17 more.