CVE-2024-5458: Filter bypass in filter_var (FILTER_VALIDATE_URL)

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-09 · updated 2026-06-17
Weakness: CWE-345

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Affected products

Fedoraproject Fedora: 40
PHP: from 7.3.27 through 7.3.33; from 7.4.15 through 7.4.33; from 8.0.2 through 8.0.30; from 8.1.0 before 8.1.29; from 8.2.0 before 8.2.20; from 8.3.0 before 8.3.8 — fixed in 8.1.29, 8.2.20, 8.3.8

How to fix

Upgrade to a fixed version: PHP 8.1.29, 8.2.20, 8.3.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-5458 or the next vulnerability affects your stack