User-supplied request headers are not fully validated for end-of-line characters, so some headers (for example Authorization) may be dropped or misinterpreted.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.4 | < 8.4.5 | 8.4.5 |
| PHP 8.3 | < 8.3.19 | 8.3.19 |
| PHP 8.2 | < 8.2.28 | 8.2.28 |
| PHP 8.1 | < 8.1.32 | 8.1.32 |
Older branches: not assessed
Exploitation conditions
No special conditions are documented.
Remediation
Upgrade to 8.1.32, 8.2.28, 8.3.19, 8.4.5 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 6.3 v4.0 | CNA | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source