CVE-2025-1861

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-131

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-18627.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL upCVE-2025-18639.8Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentCVE-2025-18649.8Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issuCVE-2025-18657.8The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling procCVE-2025-186610.0Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows Pointer Manipulation, CVE-2025-186710.0Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response SmuggliCVE-2025-18686.8Vulnerability of unauthorized exposure of confidential information affecting Advanced IP Scanner and Advanced Port Scanner. It occurs when tCVE-2025-18699.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/check_avalability.phpCVE-2025-18709.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagedescription" parameter in admin/aboutus.php.CVE-2025-18719.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/adCVE-2025-18729.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.pCVE-2025-18739.8SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagetitle" and "pagedescription" parameters in adm