CVE-2025-1861

Katalog CVE

CVSS 9.8 · Critical EPSS 0,84%

Kerentanan Incorrect Calculation of Buffer Size pada php, netapp ontap. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

Rincian

Terbit di NVD

30 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,84% peluang dieksploitasi; lebih tinggi dari 56,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff advisory vendor
• https://security.netapp.com/advisory/ntap-20250523-0005/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html