CVE-2025-1217: Header parser of http stream wrapper does not handle folded headers
Fixed (Header parser of http stream wrapper does not handle folded headers). (CVE-2025-1217)
Other sources
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
— Debian
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1217?
CVE-2025-1217 has been rated as a moderate severity vulnerability affecting the header parser of the HTTP stream wrapper.
How do I fix CVE-2025-1217?
To fix CVE-2025-1217, upgrade your PHP version to 8.3.19 or later.
What does CVE-2025-1217 affect?
CVE-2025-1217 affects the header parser functionality within the HTTP stream wrapper of PHP.
Is CVE-2025-1217 exploitable?
Yes, CVE-2025-1217 can be exploited to manipulate HTTP header handling, potentially leading to security issues in PHP applications.
What versions of PHP are vulnerable to CVE-2025-1217?
PHP versions below 8.3.19 are vulnerable to CVE-2025-1217.