How severe is CVE-2025-1861?

This vulnerability has a severity rating of MEDIUM with a CVSS score of N/A out of 10.

What type of vulnerability is CVE-2025-1861?

This is classified as CWE-131, which is a common weakness in software security.

CVE-2025-1861 - MEDIUM Severity | CVSS N/A

Vulnerability Description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

Related Vulnerabilities

CVE-2001-0248

CRITICAL

CVSS:9.8(Critical)

Buffer overflow in FTP server in HPUX 11 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings.

CWE-1312001

CVE-2001-0249

CRITICAL

CVSS:9.8(Critical)

Heap overflow in FTP daemon in Solaris 8 allows remote attackers to execute arbitrary commands by creating a long pathname and calling the LIST command, which uses glob to generate long strings.

CWE-1312001

CVE-2002-1347

CRITICAL

CVSS:9.8(Critical)

Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonical...

CWE-1312002

CVE-2003-0899

CRITICAL

CVSS:9.8(Critical)

Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the...

CWE-1312003

CVE-2004-0434

CRITICAL

CVSS:9.8(Critical)

k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, which leads to a heap-based ...

CWE-1312004

CVE-2004-1363

CRITICAL

CVSS:9.8(Critical)

Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed.

CWE-1312004