blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2024-11234

HIGH 7.2 CVSS 3.1
Published
November 24, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-20, CWE-74
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Affected products and versions

  • PHP — From 8.1.0 (including) to 8.1.31 (excluding)
  • PHP — From 8.2.0 (including) to 8.2.26 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.14 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2 Exploit, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
  • security.netapp.com https://security.netapp.com/advisory/ntap-20241220-0008/
  • nvd.nist.gov Official NVD record