CVE-2025-1217: php_group php Improper Input Validation
Vulnerability summary
CVE-2025-1217 is a medium (CVSS 6.3) Improper Input Validation vulnerability in php_group php. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 17 · Related 7Timeline
- 29-03-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.01 pp
From 0.56% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPhp Src
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Affected systems
Ubuntu6 products
- php5All versions (No fix recorded)
- php7.0< 7.0.33-0ubuntu0.16.04.16+esm15
- php7.2< 7.2.24-0ubuntu0.18.04.17+esm8
- php7.4< 7.4.3-4ubuntu2.29
- php8.1< 8.1.2-1ubuntu2.21
Debian2 products
- php8.2< 8.2.28-1~deb12u1
- php8.4< 8.4.5-1
Php1 product
- php≥ 8.1.0, < 8.1.32 | ≥ 8.2.0, < 8.2.28 | ≥ 8.3.0, < 8.3.19 | ≥ 8.4.0, < 8.4.5
Php_group1 product
- php≥ 8.1.*, < 8.1.32 | ≥ 8.2.*, < 8.2.28 | ≥ 8.3.*, < 8.3.19 | ≥ 8.4.*, < 8.4.5
4 vendors · 10 products
