What’s Vulnerable › Vulnerabilities

CVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIs

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-24 · updated 2026-06-17
• Weakness: CWE-20

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Affected products

• PHP: from 8.1.0 before 8.1.31; from 8.2.0 before 8.2.26; from 8.3.0 before 8.3.14 — fixed in 8.1.31, 8.2.26, 8.3.14

How to fix

Upgrade to a fixed version: PHP 8.1.31, 8.2.26, 8.3.14. Check the vendor advisory for mitigations.

References

• https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2
• https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
• https://security.netapp.com/advisory/ntap-20241220-0008/

Get alerted when CVE-2024-11234 or the next vulnerability affects your stack