BIT-libphp-2025-1735

vendorUSosv

pgsql extension does not check for errors during escaping

view advisory published 2025-08-11Licence: per source

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-1735US	high7.5	1.16% (67th)	—	2025-07-13
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returne…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/07/11/4WEB
https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3ADVISORY
https://lists.debian.org/debian-lts-announce/2025/07/msg00017.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-1735WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan