CVE-2024-11234
php: Configuring a proxy in a stream context might allow for CRLF injection in URIs
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 24, 2024
Updated · June 30, 2026
Description
A flaw was found in PHP. In affected versions of PHP, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not usually available to the external user.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-20 · Improper Input Validation