CVE-2025-1861: Critical HTTP Redirect Truncation in PHP

CVE-2025-1861 is a PHP flaw in the HTTP stream wrapper that cuts redirect Location values to 1024 bytes, which can send a request to the wrong URL. It is scored critical at 9.8 in the record. Upgrade to PHP 8.1.32, 8.2.28, 8.3.19 or 8.4.5 or later.

What's affected

PHP's HTTP stream wrapper, the code behind functions such as file_get_contents when given an http URL, keeps the Location header of a redirect in a buffer of 1024 bytes. RFC 9110 recommends supporting at least 8000. A longer value is cut short.

• Affected: PHP 8.1 before 8.1.32, 8.2 before 8.2.28, 8.3 before 8.3.19 and 8.4 before 8.4.5. The GitHub advisory lists 8.3 as below 8.3.18 in its table, while the CVE text and the patched list both say 8.3.19, so use 8.3.19 or later.
• Fixed: 8.1.32, 8.2.28, 8.3.19, 8.4.5
• Also listed: NetApp ONTAP, per the record's product list and a NetApp advisory it references
• Severity: Critical, CVSS 9.8 in the record (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The GitHub advisory rates it Moderate.
• Known exploited (CISA KEV): no, the record's kev flag is false

The score gap deserves a note. The advisory describes the effect as URL truncation that may drop information from the query or redirect to another resource, and says it could cause a denial of service at the remote site if the shortened URL leads to an error. Read the advisory text, not only the number, when you decide how urgent this is for you.

How to check if you're exposed

Check the PHP version on every host and in every container image.

php -v
php -r 'echo PHP_VERSION, PHP_EOL;'

For containers, check the base image tag and the PHP version inside a running container.

docker run --rm your-image:tag php -v

Then ask whether your code fetches remote URLs with the built in HTTP wrapper and follows redirects. Search your source for calls that take a remote URL.

grep -rnE "file_get_contents\(|fopen\(|file\(" --include=*.php . | grep -i http

Code that fetches only fixed internal URLs is less exposed than code that follows redirects from services you do not control. Debian published a long term support notice, linked in the record, so check your distribution's package changelog too, since fixes are often backported without a version bump to the upstream number.

What to do now

1. Upgrade PHP to 8.1.32, 8.2.28, 8.3.19 or 8.4.5, or a later release in your branch.
2. On distribution packages, install the update from your vendor and read its changelog for CVE-2025-1861.
3. Rebuild and redeploy container images that bundle PHP, then confirm the version in the running image.
4. Review code that follows redirects from third party services. Consider an HTTP client library where you control redirect handling, and validate where a redirect ends up.
5. For NetApp ONTAP, follow the NetApp advisory the record references.
6. The advisory says there is no real workaround, so patching is the path.

Why it matters

The cause is an incorrect calculation of buffer size (CWE-131). A fixed 1024 byte buffer holds a value that standards allow to be longer, so the value is truncated silently. The program carries on with a URL that is not the one the server sent.

Redirects often carry state in their query strings, such as tokens or return addresses. Dropping the tail can send a request to a different resource or to an error page. That is a correctness bug with security effects, and the fix is simply a larger limit. The lesson for your own code is to use limits that match the standard and to fail loudly when input is too long.

The record maps this to CWE-131 (Incorrect Calculation of Buffer Size).

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-1861
• GitHub advisory GHSA-52jp-hrpf-2jff
• Debian LTS announcement and NetApp advisory, both listed in the record and not fetched for this page

Last reviewed: 19 October 2026.