Описание
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size.
Отчет
Moderate-impact vulnerability affecting PHP in Red Hat Enterprise Linux: PHP's HTTP stream wrapper can truncate an HTTP redirect Location value at 1024 bytes, causing an HTTP client to follow an incorrect URL. Red Hat's CVSS 5.3 assessment reflects limited confidentiality impact with no integrity or availability impact established by the current evidence; the NIST 9.8 Critical score assumes high impact to confidentiality, integrity, and availability. The current scope marks selected Red Hat Enterprise Linux streams as affected or delegated, Red Hat Enterprise Linux 6 and 7 as out of standard support, and Red Hat In-Vehicle OS streams as deferred; for the deferred products, the residual risk is incorrect URL truncation and redirection, and remediation is deferred. Delegated Red Hat Enterprise Linux streams are being handled through the relevant product teams' remediation process. Fedora 40 and Fedora 41 are not affected because inline mitigations already exist.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | php | Out of support scope | ||
| Red Hat Enterprise Linux 7 | php | Out of support scope | ||
| Red Hat Enterprise Linux 10 | php | Fixed | RHSA-2025:7489 | 13.05.2025 |
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2025:15687 | 11.09.2025 |
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2026:2470 | 10.02.2026 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2025:4263 | 28.04.2025 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2025:7418 | 13.05.2025 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2025:7431 | 13.05.2025 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2025:7432 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* ...
Stream HTTP wrapper truncate redirect location to 1024 bytes
EPSS
5.3 Medium
CVSS3