PT-2025-11345 · Php+11 · Php+11

Jakub Zelenka · Published 2025-01-01 · Updated 2026-02-10 · CVE-2025-1734

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: PHP versions up to 8.1.31 PHP versions up to 8.2.27 PHP versions up to 8.3.18 PHP versions up to 8.4.4 php7.4

Description: The issue concerns the Streams HTTP Wrapper in PHP.

Recommendations: For PHP versions up to 8.1.31, update to a version later than 8.1.31. For PHP versions up to 8.2.27, update to a version later than 8.2.27. For PHP versions up to 8.3.18, update to a version later than 8.3.18. For PHP versions up to 8.4.4, update to a version later than 8.4.4. For php7.4, consider upgrading to a newer version of PHP.

Fix

HTTP Request/Response Smuggling

RCE

Weakness Enumeration

CWE-444

CWE-20

Related Identifiers

ALSA-2025:15687

ALSA-2025:4263

ALSA-2025:7418

ALSA-2025:7431

ALSA-2025:7432

ALSA-2025:7489

ALSA-2026:2470

ALT-PU-2025-4202

ALT-PU-2025-4313

ALT-PU-2025-4317

ALT-PU-2025-4377

ALT-PU-2025-4406

ALT-PU-2025-4565

AZL-59315

AZL-59334

BDU:2025-02827

BIT-LIBPHP-2025-1734

BIT-PHP-2025-1734

BIT-PHP-MIN-2025-1734

CESA-2025_15687

CVE-2025-1734

DLA-4088-1

DSA-5878-1

GHSA-PCMH-G36C-QC44

INFSA-2025_15687

INFSA-2025_4263

INFSA-2025_7418

INFSA-2025_7431

INFSA-2025_7432

MGASA-2025-0100

OESA-2025-1302

OESA-2025-1303

OESA-2025-1304

OESA-2025-1305

OESA-2025-1306

OPENSUSE-SU-2025:14895-1

OPENSUSE-SU-2025_0994-1

OPENSUSE-SU-2025_1012-1

OPENSUSE-SU-2025_1025-1

RHSA-2025:4263

RHSA-2025:7418

RHSA-2025:7431

RHSA-2025:7432

RHSA-2025:7489

RHSA-2025_15687

RHSA-2025_4263

RHSA-2025_7418

RHSA-2025_7431

RHSA-2025_7432

RHSA-2026:2470

SUSE-SU-2025:0994-1

SUSE-SU-2025:1012-1

SUSE-SU-2025:1025-1

SUSE-SU-2025:1026-1

USN-7400-1

USN-7645-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Php

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 163

• https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11235 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:7432 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7645-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7400-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-59315 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-7432.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1736 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0100.html · Security Note
• https://osv.dev/vulnerability/CVE-2025-1734 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7645-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:7431 · Vendor Advisory