Vulnerability · Published Mar 30, 2025 · Assigned by php

CVE-2025-1861Stream HTTP wrapper truncates redirect location to 1024 bytes

Medium 6.3

In plain English

A medium-severity security flaw in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.9%top 41.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9apcu-panel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:10php8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-bcmath8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-bcmath7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-bcmath8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-bcmath8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-bcmath8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-bcmath8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-bcmath8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-cli8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-cli8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-cli7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-cli8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-cli8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-cli8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-cli8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-common8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-common8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-common7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-common8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-common8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-common8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-common8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-dba8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-dba7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-dba8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-dba8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-dba8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-dba8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-dba8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-dbg8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-dbg8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-dbg7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-dbg8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-dbg8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-dbg8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-dbg8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-devel8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-devel8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-devel7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-devel8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-devel8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-devel8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-devel8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:10php-embedded8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-embedded7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-embedded8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-embedded8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-embedded8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-embedded8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-embedded8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-enchant8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-enchant8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-enchant7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-enchant8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-enchant8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-enchant8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-enchant8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-ffi8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-ffi8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-ffi7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-ffi8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-ffi8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-ffi8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-ffi8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-fpm8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-fpm7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-fpm8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-fpm8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-fpm8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-fpm8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-fpm8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-gd8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-gd8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-gd7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-gd8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-gd8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-gd8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-gd8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-gmp8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-gmp8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-gmp7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-gmp8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-gmp8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-gmp8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-gmp8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-intl8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-intl8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-intl7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-intl8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-intl8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-intl8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-intl8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:8php-json7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:10php-ldap8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-ldap8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-ldap7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-ldap8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-ldap8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-ldap8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-ldap8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:10php-mbstring8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-mbstring7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-mbstring8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-mbstring8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-mbstring8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-mbstring8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-mbstring8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-mysqlnd8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-mysqlnd8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-mysqlnd7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-mysqlnd8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-mysqlnd8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-mysqlnd8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-mysqlnd8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-odbc8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-odbc7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-odbc8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-odbc8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-odbc8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-odbc8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-odbc8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-opcache8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-opcache8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-opcache7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-opcache8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-opcache8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-opcache8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-opcache8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-pdo8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-pdo7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-pdo8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-pdo8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-pdo8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-pdo8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-pdo8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-redis66.1.0-2.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:10php-pgsql8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-pgsql8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-pgsql7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-pgsql8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-pgsql8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-pgsql8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-pgsql8.0.30-3.el9_6ALSA-2025:7431

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.1.* – before 8.1.328.2.* – before 8.2.288.3.* – before 8.3.198.4.* – before 8.4.5

Weakness: CWE-131 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References