CVE-2025-1220

A flaw was found in PHP. The fsockopen() function and related functions fail to validate NULL characters within the provided hostname, potentially leading to unexpected behavior during parsing. This flaw allows a network attacker to supply a specially crafted hostname. This issue can result in a denial of service due to parsing errors.

PHP does not classify this issue as a security issue because users are expected to sanitize the input. Nevertheless, this was considered a low-impact security issue as a precaution for users who do not follow that practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.