The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-8d0acf5a57 advisory.

    **PHP version 8.3.19** (13 Mar 2025)

    **BCMath:**

    * Fixed bug [GH-17398](https://github.com/php/php-src/issues/17398) (bcmul memory leak). (SakiTakamachi)

    **Core:**

    * Fixed bug [GH-17623](https://github.com/php/php-src/issues/17623) (Broken stack overflow detection for     variable compilation). (ilutov)
    * Fixed bug [GH-17618](https://github.com/php/php-src/issues/17618) (UnhandledMatchError does not take     zend.exception_ignore_args=1 into account). (timwolla)
    * Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
    * Fixed bug [GH-17718](https://github.com/php/php-src/issues/17718) (Calling static methods on an     interface that has `__callStatic` is allowed). (timwolla)
    * Fixed bug [GH-17797](https://github.com/php/php-src/issues/17797) (zend_test_compile_string crash on     invalid script path). (David Carlier)
    * Fixed [GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477)     (Reference counting in php_request_shutdown causes Use-After-Free). (**CVE-2024-11235**) (ilutov)

    **DOM:**

    * Fixed bug [GH-17847](https://github.com/php/php-src/issues/17847) (xinclude destroys live node).
    (nielsdos)

    **FFI:**

    * Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)

    **FPM:**

    * Fixed bug [GH-17643](https://github.com/php/php-src/issues/17643) (FPM with httpd ProxyPass encoded     PATH_INFO env). (Jakub Zelenka)

    **GD:**

    * Fixed bug [GH-17772](https://github.com/php/php-src/issues/17772) (imagepalettetotruecolor crash with     memory_limit=2M). (David Carlier)

    **LDAP:**

    * Fixed bug [GH-17704](https://github.com/php/php-src/issues/17704) (ldap_search fails when $attributes     contains a non-packed array with numerical keys). (nielsdos, 7u83)

    **LibXML:**

    * Fixed [GHSA-wg4p-4hqh-c3g9](https://github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9)     (Reocurrence of php#72714). (nielsdos)
    * Fixed [GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc)     (libxml streams use wrong `content-type` header when requesting a redirected resource).
    (**CVE-2025-1219**) (timwolla)

    **MBString:**

    * Fixed bug [GH-17503](https://github.com/php/php-src/issues/17503) (Undefined float conversion in     mb_convert_variables). (cmb)

    **Opcache:**

    * Fixed bug [GH-17654](https://github.com/php/php-src/issues/17654) (Multiple classes using same trait     causes function JIT crash). (nielsdos)
    * Fixed bug [GH-17577](https://github.com/php/php-src/issues/17577) (JIT packed type guard crash).
    (nielsdos, Dmitry)
    * Fixed bug [GH-17899](https://github.com/php/php-src/issues/17899) (zend_test_compile_string with invalid     path when opcache is enabled). (David Carlier)
    * Fixed bug [GH-17868](https://github.com/php/php-src/issues/17868) (Cannot allocate memory with tracing     JIT). (nielsdos)

    **PDO_SQLite:**

    * Fixed [GH-17837](https://github.com/php/php-src/issues/17837) ()::getColumnMeta() on unexecuted     statement segfaults). (cmb)
    * Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)

    **Phar:**

    * Fixed bug [GH-17808](https://github.com/php/php-src/issues/17808): PharFileInfo refcount bug. (nielsdos)

    **PHPDBG:**

    * Partially fixed bug [GH-17387](https://github.com/php/php-src/issues/17387) (Trivial crash in phpdbg     lexer). (nielsdos)
    * Fix memory leak in phpdbg calling registered function. (nielsdos)

    **Reflection:**

    * Fixed bug [GH-15902](https://github.com/php/php-src/issues/15902) (Core dumped in     ext/reflection/php_reflection.c). (DanielEScherzer)

    **Standard:**

    * Fixed bug php#72666 (stat cache clearing inconsistent between file:// paths and plain paths). (Jakub     Zelenka)

    **Streams:**

    * Fixed bug [GH-17650](https://github.com/php/php-src/issues/17650) (realloc with size 0 in     user_filters.c). (nielsdos)
    * Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
    * Fixed [GHSA-hgf54-96fm-v528](https://github.com/php/php-src/security/advisories/GHSA-hgf54-96fm-v528)     (Stream HTTP wrapper header check might omit basic auth header). (**CVE-2025-1736**) (Jakub Zelenka)
    * Fixed [GHSA-52jp-hrpf-2jff](https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff)     (Stream HTTP wrapper truncate redirect location to 1024 bytes). (**CVE-2025-1861**) (Jakub Zelenka)
    * Fixed [GHSA-pcmh-g36c-qc44](https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44)     (Streams HTTP wrapper does not fail for headers without colon). (**CVE-2025-1734**) (Jakub Zelenka)
    * Fixed [GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g)     (Header parser of `http` stream wrapper does not handle folded headers). (**CVE-2025-1217**) (Jakub     Zelenka)

    **Zlib:**

    * Fixed bug [GH-17745](https://github.com/php/php-src/issues/17745) (zlib extension incorrectly handles     object arguments). (nielsdos)
    * Fix memory leak when encoding check fails. (nielsdos)
    * Fix zlib support for large files. (nielsdos)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7432 advisory.

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

    * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

    * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4088 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4088-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     March 20, 2025                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : php7.4     Version        : 7.4.33-1+deb11u8     CVE ID         : CVE-2025-1217 CVE-2025-1219 CVE-2025-1734 CVE-2025-1736                      CVE-2025-1861

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language, which could result in HTTP request     smuggling, validation bypass or denial of service.

    CVE-2025-1217

        Tim Dsterhus discovered that the header parser of the `http` stream         wrapper does not handle folded headers and passes incorrect MIME         types to an attached stream notifier.

    CVE-2025-1219

        Tim Dsterhus discovered that when requesting a HTTP resource using         the DOM or SimpleXML extensions, the wrong `content-type` header is         used to determine the charset when the requested resource performs a         redirect.

    CVE-2025-1734

        It was discovered that the streams HTTP wrapper does not fail for         headers with invalid name and no colon, thereby violating         RFC-mandated behavior.

    CVE-2025-1736

        It was discovered that the stream HTTP wrapper header check might         omit basic auth header in some cases.

    CVE-2025-1861

        It was discovered that the stream HTTP wrapper truncate redirect         location to 1024 bytes, while the RFC-recommended length is 8000 and         browsers usually limit to around 2048.

    GHSA-wg4p-4hqh-c3g9

        An out of bound read was discovered in the XML parsing logic when         `XML_OPTION_SKIP_TAGSTART` is set to a high value and the XML         document has shorter tag names than expected.

    For Debian 11 bullseye, these problems have been fixed in version     7.4.33-1+deb11u8.

    We recommend that you upgrade your php7.4 packages.

    For the detailed security status of php7.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php7.4

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1026-1 advisory.

    - CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)
    - CVE-2025-1217: Fixed header parser of http stream wrapper not handling folded headers (bsc#1239664)
    - CVE-2025-1219: Fixed libxml streams using wrong content-type header when requesting a redirected     resource (bsc#1239667)
    - CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon     (bsc#1239668)
    - CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)
    - CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.28-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2025-007 advisory.

    Header parser of `http` stream wrapper does not handle folded headers. (CVE-2025-1217)

    When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is     used to determine the charset when the requested resource performs a redirect. (CVE-2025-1219)

    Streams HTTP wrapper does not fail for headers with invalid name and no colon. (CVE-2025-1734)

    Stream HTTP wrapper header check might omit basic auth header. (CVE-2025-1736)

    Stream HTTP wrapper truncate redirect location to 1024 bytes (CVE-2025-1861)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is version 6.3.0, 6.4.0, 6.4.5, or 6.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-04 advisory.

  - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache     entry, making it end sooner or later than otherwise intended. This affects curl using applications that     enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like     `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS     cache either needs to have been populated manually or there needs to have been previous HTTPS accesses     done as the cache needs to have entries for the domains involved to trigger this problem.) When     `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's     expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The     result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different     period of time than what was asked for by the origin server. If `example.com` for example stops supporting     HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set)     timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently     switch back to insecure HTTP earlier than otherwise intended. (CVE-2024-9681)

  - Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial     can lead to out-of-bounds memory reads or writes. (CVE-2024-9143)

  - Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the     field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory     writes can lead to an application crash or even a possibility of a remote code execution, however, in all     the protocols involving Elliptic Curve Cryptography that we're aware of, either only named curves are     supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary     (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a     vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509     certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any     problematic use-cases would have to be using an exotic curve encoding. The affected APIs include:
    EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.
    Applications working with exotic explicit binary (GF(2^m)) curve parameters, that make it possible to     represent invalid field polynomials with a zero constant term, via the above or similar APIs, may     terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot     easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
    (CVE-2024-9143)

  - When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the     password used for the first host to the followed-to host under certain circumstances. This flaw only     manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry     either omits just the password or omits both login and password. (CVE-2024-11053)

  - Issue summary: A timing side-channel which could potentially allow recovering the private key exists in     the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations     could allow recovering the private key by an attacker. However, measuring the timing would require either     local access to the signing application or a very fast network connection with low latency. There is a     timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This     can happen with significant probability only for some of the supported elliptic curves. In particular the     NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located     in the same physical computer or must have a very fast network connection with low latency. For that     reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are     affected by this issue. (CVE-2024-13176)

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)

  - libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode     conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading     outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then     fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack     contents accidently getting returned as part of the converted string. (CVE-2024-6874)

  - libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time     field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the
    *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not     (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents     getting returned to the application when     [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. (CVE-2024-7264)

  - When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling,     to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead     wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like     for example 'unauthorized') it is not treated as a bad certficate. (CVE-2024-8096)

  - When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the     password used for the first host to the followed-to host under certain circumstances. This flaw only     manifests itself if the netrc file has a `default` entry that omits both login and password. A rare     circumstance. (CVE-2025-0167)

  - libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel     after having completed a threaded name resolve. (CVE-2025-0665)

  - When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the     `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow     would make libcurl perform a buffer overflow. (CVE-2025-0725)

  - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before     8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed     incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
    (CVE-2025-1217)

  - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before     8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type     header is used to determine the charset when the requested resource performs a redirect. This may cause     the resulting document to be parsed incorrectly or bypass validations. (CVE-2025-1219)

  - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before     8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid     headers even though they are not. This may confuse applications into accepting invalid headers.
    (CVE-2025-1734)

  - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before     8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may     prevent certain headers from being sent or lead to certain headers be misinterpreted. (CVE-2025-1736)

  - In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before     8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the     location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the     limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong     location. (CVE-2025-1861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4263 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

    * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

    * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7431 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15687 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

    * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

    * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9901:01 advisory.

    php: Leak partial content of the heap through heap buffer over-read in mysqlnd     (CVE-2024-8929)      php: Single byte overread with convert.quoted-printable-decode filter     (CVE-2024-11233)      php: Configuring a proxy in a stream context might allow for CRLF injection in     URIs (CVE-2024-11234)      php: Header parser of http stream wrapper does not handle folded headers     (CVE-2025-1217)      php: Stream HTTP wrapper header check might omit basic auth header     (CVE-2025-1736)      php: Streams HTTP wrapper does not fail for headers with invalid name and no     colon (CVE-2025-1734)      php: libxml streams use wrong content-type header when requesting a redirected     resource (CVE-2025-1219)      php: Stream HTTP wrapper truncates redirect location to 1024 bytes     (CVE-2025-1861)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10557:01 advisory.

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
      * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
      * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
      * php: libxml streams use wrong content-type header when requesting a redirected resource     (CVE-2025-1219)
      * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
      * php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10450:05 advisory.

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
      * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
      * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
      * php: libxml streams use wrong content-type header when requesting a redirected resource     (CVE-2025-1219)
      * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2470 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

    * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

    * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    * php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

    * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

    * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

    * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

    * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images     (CVE-2025-14177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-182:01 advisory.

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
      * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
      * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
      * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
      * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
      * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
      * php: libxml streams use wrong content-type header when requesting a redirected resource     (CVE-2025-1219)
      * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
      * php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
      * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
      * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
      * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
      * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images     (CVE-2025-14177)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
233170	Fedora 41 : php (2025-8d0acf5a57)	Nessus	Fedora Local Security Checks	3/21/2025	1/21/2026	medium
243150	RockyLinux 9 : php:8.2 (RLSA-2025:7432)	Nessus	Rocky Linux Local Security Checks	7/30/2025	7/30/2025	medium
233010	Debian dla-4088 : libapache2-mod-php7.4 - security update	Nessus	Debian Local Security Checks	3/20/2025	3/20/2025	critical
233395	SUSE SLES15 Security Update : php7 (SUSE-SU-2025:1026-1)	Nessus	SuSE Local Security Checks	3/27/2025	1/21/2026	high
233685	Amazon Linux 2 : php (ALASPHP8.2-2025-007)	Nessus	Amazon Linux Local Security Checks	4/1/2025	1/21/2026	medium
234507	Tenable Security Center Multiple Vulnerabilities (TNS-2025-04)	Nessus	Misc.	4/16/2025	4/16/2025	high
234912	RHEL 9 : php:8.1 (RHSA-2025:4263)	Nessus	Red Hat Local Security Checks	4/28/2025	6/5/2025	medium
237315	RHEL 9 : php (RHSA-2025:7431)	Nessus	Red Hat Local Security Checks	5/27/2025	6/5/2025	medium
264556	RHEL 8 : php:8.2 (RHSA-2025:15687)	Nessus	Red Hat Local Security Checks	9/11/2025	9/11/2025	medium
283144	MiracleLinux 9 : php:8.1 (AXSA:2025-9901:01)	Nessus	Miracle Linux Local Security Checks	1/13/2026	1/20/2026	medium
283343	MiracleLinux 9 : php:8.3 (AXSA:2025-10557:01)	Nessus	Miracle Linux Local Security Checks	1/13/2026	1/20/2026	medium
283348	MiracleLinux 9 : php-8.0.30-3.el9_6 (AXSA:2025-10450:05)	Nessus	Miracle Linux Local Security Checks	1/13/2026	1/13/2026	medium
298591	RHEL 8 : php:7.4 (RHSA-2026:2470)	Nessus	Red Hat Local Security Checks	2/10/2026	2/10/2026	medium
299184	MiracleLinux 8 : php:7.4 (AXSA:2026-182:01)	Nessus	Miracle Linux Local Security Checks	2/16/2026	2/19/2026	medium

Detections

Analytics

Plugins Search

medium

medium

critical

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium