Riskcovery

CVE-2025-1220

Null byte termination in hostnames

State
Published
Severity
3.7 Low
Published
Jul 13, 2025
Updated
Nov 4, 2025
Reserved
Feb 11, 2025

Read the record on cve.org

Description

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

Scores

CVSSScoreVectorSource
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nphp

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
PHPPHP Group
  • 8.1.* to before 8.1.33Affected
  • 8.2.* to before 8.2.29Affected
  • 8.3.* to before 8.3.23Affected
  • 8.4.* to before 8.4.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.