CVE-2025-1736: Stream HTTP wrapper header check might omit basic auth header
Fixed (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
Other sources
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
— Debian
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1736?
CVE-2025-1736 is categorized as a moderate severity vulnerability.
How do I fix CVE-2025-1736?
To fix CVE-2025-1736, upgrade PHP to version 8.3.19 or later.
What type of vulnerability is CVE-2025-1736?
CVE-2025-1736 is a vulnerability related to the omission of basic authentication headers in HTTP stream wrappers.
What versions of PHP are affected by CVE-2025-1736?
CVE-2025-1736 affects all PHP versions prior to 8.3.19.
Is there a workaround for CVE-2025-1736?
There is no documented workaround for CVE-2025-1736; updating PHP to the fixed version is recommended.