PHP security releases of March 2025: 8.4.5, 8.3.19, 8.2.28 and 8.1.32

On 13 March 2025 the PHP project released PHP 8.4.5, 8.3.19, 8.2.28 and 8.1.32, each announced as a security release. Together they fix five CVEs in the HTTP stream wrapper and libxml handling, a use-after-free in request shutdown that affects only 8.3 and 8.4, and a low-rated XML parser over-read that has a GitHub advisory but no CVE.

At a glance

What the vulnerabilities are

HTTP stream wrapper and libxml (all four branches)

Five fixes concern what happens when PHP code fetches a URL through the built-in http:// stream wrapper, for example with file_get_contents() or fopen(), or loads remote XML through DOM or SimpleXML:

• CVE-2025-1217: folded (multi-line) response headers were parsed incorrectly, which may lead to the wrong headers or MIME type being used.
• CVE-2025-1734: response header lines without a colon were accepted as valid, which may confuse code that reads $http_response_header.
• CVE-2025-1736: weak validation of end-of-line characters in user-supplied request headers could stop some headers, such as an authorization header, from being sent or cause them to be misinterpreted.
• CVE-2025-1861: redirect Location values were cut at 1,024 bytes, which could drop part of the target URL or lead to a different resource.
• CVE-2025-1219: when DOM or SimpleXML followed a redirect, the character set was taken from the wrong Content-Type header.

PHP rates each of these Medium, and each CVE record carries a CVSS 4.0 score of 6.3.

Use-after-free in request shutdown (8.3 and 8.4 only)

CVE-2024-11235 (GHSA-rwp7-7vc6-8477) is a use-after-free reached through code that combines a __set handler or the ??= operator with exceptions. The CVE description says that if a third party can control the memory layout, for example with crafted input to the script, it could lead to remote code execution. PHP's GitHub advisory labels it Medium, but the CVE record PHP published gives it CVSS 4.0 base 9.2 (Critical), so treat it as the priority item on 8.3 and 8.4.

XML parser over-read (all branches)

GHSA-wg4p-4hqh-c3g9, rated Low, is a return of an old bug: setting XML_OPTION_SKIP_TAGSTART higher than the length of a tag name could read out of bounds and leak heap contents.

None of these CVEs is listed in CISA's Known Exploited Vulnerabilities catalog (checked against the 30 October 2026 edition).

Are you affected?

Check the PHP version that actually serves your sites, not only the command-line one:

php -v
php -r 'echo PHP_VERSION, PHP_EOL;'
php-fpm8.2 -v   # Debian/Ubuntu naming; change 8.2 to your branch

An upstream build older than 8.4.5, 8.3.19, 8.2.28 or 8.1.32 is affected. Distribution packages work differently: Debian and Ubuntu backport fixes into their own version strings, so compare against the distribution advisory. On Debian 12 (bookworm), DSA-5878-1 fixed the five stream-wrapper and libxml CVEs in php8.2 8.2.28-1~deb12u1:

dpkg -l 'php8.2*'
apt policy php8.2-fpm php8.2-cli

On Ubuntu, check Ubuntu Security Notices for your release.

How to update

• Debian or Ubuntu packages: run sudo apt update and then sudo apt upgrade. Updating today installs the newest security build for your release, which includes these fixes and later ones.
• Third-party repositories and control panels: update PHP through the channel you installed it from, then confirm the version.
• Source builds and Windows: download the current release of your branch from php.net/downloads and verify the published SHA-256 checksum.
• Containers: rebuild images on a base that ships a fixed PHP and redeploy; a running container keeps its old PHP.

These March 2025 versions have long been superseded. As of 31 October 2026 the current releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so update straight to those. PHP 8.1 reached end of life on 31 December 2025; its last release was 8.1.34.

Restart or reboot?

No reboot is needed. Restart every long-running process that has PHP loaded:

sudo systemctl restart php8.2-fpm
sudo systemctl restart apache2   # only if you use mod_php (libapache2-mod-php8.2)

Also restart queue workers, schedulers and other PHP daemons run by Supervisor or systemd. Command-line scripts use the new binary on their next run.

Sources

• php.net/releases/8_4_5.php
• php.net/releases/8_1_32.php
• php.net/archive/2025.php
• php.net/ChangeLog-8.php#8.4.5
• github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477
• github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9
• github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc
• github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528
• github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff
• github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44
• github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g
• cve.org/CVERecord?id=CVE-2024-11235
• nvd.nist.gov/vuln/detail/CVE-2024-11235
• cve.org/CVERecord?id=CVE-2025-1861
• security-tracker.debian.org/tracker/DSA-5878-1
• lists.debian.org/debian-security-announce/2025/msg00040.html
• packages.debian.org/source/bookworm/php8.2
• php.net/supported-versions.php
• php.net/eol.php
• cisa.gov/known-exploited-vulnerabilities-catalog