CVE-2025-1220 is a vulnerability in PHP where certain functions, including fsockopen(), do not validate that hostnames lack null characters. This discrepancy can cause functions like parse_url() to interpret hostnames differently, potentially bypassing access checks implemented in user code. The issue affects PHP versions 8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, and 8.4.* before 8.4.10. Red Hat has released patches for these versions in their Enterprise Linux 8 distributions.

If exploited, this vulnerability could allow attackers to bypass hostname-based access controls in PHP applications that rely on functions like fsockopen() and parse_url() for validation. This may lead to unauthorized access or other security problems depending on the application logic. No known exploits are reported in the wild at this time.

A patch is available and should be applied to affected PHP versions. Red Hat has released updated packages for Red Hat Enterprise Linux 8 that fix this vulnerability. Users should update to PHP versions 8.1.33 or later, 8.2.29 or later, 8.3.23 or later, or 8.4.10 or later as appropriate. Refer to the Red Hat advisory RHSA-2026:1412 for detailed update instructions.