CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header

What is CVE-2025-1736?

CVE-2025-1736 is a medium-severity vulnerability in Php Php, published on 30 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

Weakness: CWE-20

Which versions are affected by CVE-2025-1736?

3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.

Products include Netapp Ontap, Php Php.

How do I fix CVE-2025-1736?

Upgrade libphp to a fixed version for your release line: 8.1.32, 8.2.28, 8.3.19 or 8.4.5.

Is CVE-2025-1736 being exploited?

There is no known exploitation of CVE-2025-1736 in the wild and no public exploit code.

Other vulnerabilities in Php Php

• CVE-2024-8932 OOB access in ldap_escape Critical 9.8
• CVE-2026-22049 Auth bypass in ONTAP 9 High 8.7
• CVE-2026-22050 Business logic in ONTAP 9 Medium 6.9
• CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon Medium 6.3
• CVE-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes Medium 6.3

All Php Php vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-59303, AZL-59331, BELL-CVE-2025-1736, BIT-libphp-2025-1736, BIT-php-2025-1736, BIT-php-min-2025-1736 and 15 more.