CVE-2025-1861

score

<0.1

cvss

9.8

epss

0.8%

published

2025-03-30

kev added

—

first seen

2026-10-21

PHP versions 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, and 8.4.* before 8.4.5 contain a vulnerability caused by a limited size buffer when parsing HTTP redirect locations, letting attackers cause URL truncation and incorrect redirects, exploit requires sending crafted HTTP responses.