CVE-2025-1217 describes a vulnerability in PHP's HTTP stream wrapper where folded HTTP headers are parsed incorrectly. This flaw exists in PHP versions 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, and 8.4.* before 8.4.5. The incorrect parsing may cause the HTTP response to be misinterpreted, potentially leading to the use of incorrect headers or MIME types. The issue is tracked and patched by Red Hat in their advisory RHSA-2025:7431, which also addresses related PHP stream wrapper vulnerabilities. No CVSS score is provided, but the vendor rates the impact as moderate.

Misinterpretation of HTTP responses due to incorrect parsing of folded headers can cause applications relying on PHP's HTTP stream wrapper to use incorrect headers or MIME types. This may affect application behavior or security controls that depend on accurate HTTP header processing. No known exploits are reported in the wild.

A security update fixing this vulnerability is available and should be applied. Red Hat has released patched PHP packages in Red Hat Enterprise Linux 9 and related variants as detailed in advisory RHSA-2025:7431. Users should upgrade to PHP versions 8.1.32 or later, 8.2.28 or later, 8.3.19 or later, or 8.4.5 or later to remediate this issue. Refer to the vendor advisory for update instructions.