CVE-2025-1861

A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size.

Moderate-impact vulnerability affecting PHP in Red Hat Enterprise Linux: PHP's HTTP stream wrapper can truncate an HTTP redirect Location value at 1024 bytes, causing an HTTP client to follow an incorrect URL. Red Hat's CVSS 5.3 assessment reflects limited confidentiality impact with no integrity or availability impact established by the current evidence; the NIST 9.8 Critical score assumes high impact to confidentiality, integrity, and availability. The current scope marks selected Red Hat Enterprise Linux streams as affected or delegated, Red Hat Enterprise Linux 6 and 7 as out of standard support, and Red Hat In-Vehicle OS streams as deferred; for the deferred products, the residual risk is incorrect URL truncation and redirection, and remediation is deferred. Delegated Red Hat Enterprise Linux streams are being handled through the relevant product teams' remediation process. Fedora 40 and Fedora 41 are not affected because inline mitigations already exist.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.