CVE-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes

What is CVE-2025-1861?

CVE-2025-1861 is a medium-severity vulnerability in Php Php, published on 30 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

Weakness: CWE-131

Which versions are affected by CVE-2025-1861?

3 open source packages ship an affected version, including libphp, php and php-min. It affects 2 products.

Products include Netapp Ontap, Php Php.

How do I fix CVE-2025-1861?

Upgrade libphp to a fixed version for your release line: 8.1.32, 8.2.28, 8.3.19 or 8.4.5.

Is CVE-2025-1861 being exploited?

There is no known exploitation of CVE-2025-1861 in the wild and no public exploit code.

Other vulnerabilities in Php Php

• CVE-2024-8932 OOB access in ldap_escape Critical 9.8
• CVE-2026-22049 Auth bypass in ONTAP 9 High 8.7
• CVE-2026-22050 Business logic in ONTAP 9 Medium 6.9
• CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon Medium 6.3
• CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header Medium 6.3

All Php Php vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-59306, AZL-59330, BELL-CVE-2025-1861, BIT-libphp-2025-1861, BIT-php-2025-1861, BIT-php-min-2025-1861 and 10 more.