CVE-2024-11234

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

How to fix CVE-2024-11234

To remediate CVE-2024-11234, upgrade the affected package to a fixed version below.

—upgrade to 8.1.31 or later
—upgrade to 8.1.31 or later
—upgrade to 8.1.31 or later
—upgrade to 7.4.33-1+deb11u7 or later
—upgrade to 8.2.26-1~deb12u1 or later

Is CVE-2024-11234 being exploited?

Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

from 0, < 8.1.31, >= 8.2.0, < 8.2.26, >= 8.3.0, < 8.3.14
from 0, < 8.1.31, >= 8.2.0, < 8.2.26, >= 8.3.0, < 8.3.14
from 0, < 8.1.31, >= 8.2.0, < 8.2.26, >= 8.3.0, < 8.3.14
from 0, < 7.4.33-1+deb11u7
from 0, < 8.2.26-1~deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N