CVE-2024-11234

7.2 highEPSS 1.1%

High (7.2) in php php. EPSS 1.1% chance of exploitation in the next 30 days.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-20
Published: 2024-11-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

php:php

References

https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2
https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
https://security.netapp.com/advisory/ntap-20241220-0008/

Check your stack JSON