Threats tagged 'bit-php-2025-1220'

A vulnerability in PHP versions 8.1 before 8.1.33, 8.2 before 8.2.29, 8.3 before 8.3.23, and 8.4 before 8.4.10 allows null byte characters in hostnames passed to functions like fsockopen(). This can cause inconsistent hostname parsing by other functions such as parse_url(), potentially leading to security issues if user code relies on these functions for access control. Red Hat has issued security updates addressing this issue.