CVE-2025-1861

Php 8.1.0 – 8.1.31

Published

30 March 2025

Modified

03 November 2025

Patch / advisory

View advisory

CVSS Score v4 6.3

Click a component to see what it means

Raw vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0082 54th percentile

Risk Priority 42 floored blend · peak EPSS

Summary

CVE-2025-1861 is a medium-severity Incorrect Calculation of Buffer Size (CWE-131) vulnerability in Php Php. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is an incorrect buffer size calculation (CWE-131) in PHP versions 8.1 before 8.1.32, 8.2 before 8.2.28, 8.3 before 8.3.19, and 8.4 before 8.4.5. When the PHP HTTP client parses a Location header in a redirect response, it uses a fixed 1024-byte buffer instead of the 8000-byte limit recommended by RFC 9110, which can cause the URL to be truncated incorrectly and the client to follow a malformed or attacker-controlled destination.

An unauthenticated remote attacker who can influence or observe an HTTP redirect response seen by a vulnerable PHP application may be able to cause the client to connect to an unintended host or path, resulting in limited information disclosure or unintended request behavior.

The referenced GitHub security advisory and vendor notices direct users to upgrade to the fixed releases listed above; Debian and NetApp have issued corresponding package updates that apply the same patches.

The associated EPSS score has remained flat at a low value of 0.0103 with no observed rise after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-15117

Vulnerability Data

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by…

limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

CWE(s): CWE-131

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-8932Same product: Netapp Ontap

CVE-2025-1736Same product: Netapp Ontap

CVE-2025-1734Same product: Netapp Ontap

CVE-2026-22050Same product: Netapp Ontap

CVE-2024-39573Same product: Netapp Ontap

CVE-2023-27317Same product: Netapp Ontap

CVE-2026-22052Same product: Netapp Ontap

CVE-2019-6977Same product: Php Php

CVE-2025-24928Same product: Netapp Ontap

CVE-2024-56171Same product: Netapp Ontap

Affected Assets

php

8.1.0 — 8.1.31 · 8.2.0 — 8.2.26 · 8.3.0 — 8.3.14

netapp

ontap

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer security testing and code review can discover incorrect buffer-size computations before deployment.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles directly require correct buffer-size arithmetic and bounds-checked allocation.

SI-10 Information Input Validation partial match

Input validation can enforce that supplied lengths or counts used in size calculations are within safe bounds.

SI-16 Memory Protection partial match

Memory-protection mechanisms limit the exploitability of an overflow that results from an incorrect size calculation.

SI-2 Flaw Remediation partial match

Flaw-remediation processes that include vulnerability scanning or static analysis will surface buffer-size errors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Secure SDLC practices directly prevent buffer-size miscalculations via coding standards, reviews, and testing, while fixing this single weakness only partially fulfills the broader control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match

degrades

Secure coding standards directly require correct buffer-size calculations.

A.8.29 Security testing in development and acceptance mostly match

finds

Security testing can detect buffer-size errors before release.

A.8.25 Secure development life cycle partial match

prevents

Secure development lifecycle mandates size-checking practices that reduce buffer-size miscalculations.

A.8.26 Application security requirements partial match

prevents

Application security requirements can specify buffer-size validation rules.