CVE-2025-1220

Null byte termination in hostnames

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

We have discovered 389,863 live websites that are affected by CVE-2025-1220.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains389,863 live websites (5.53% of PHP install base)
Vulnerable Versions
  • from 8.1 through 8.1.33
  • from 8.2 through 8.2.29
  • from 8.3 through 8.3.23
  • from 8.4 through 8.4.10
Vulnerable Versions Count95 versions ( 18% of all versions)


Common Weakness Enumeration

CWE-918 Server-Side Request Forgery (SSRF)



Details

  • Published - Jul 13, 2025
  • Updated - Nov 4, 2025

Credits

  • Jihwan Kim (reporter)

Website Distribution by Country

Number of websites using CVE-2025-1220
United States75,649 websites


France111,135 websites
Russia56,709 websites
Netherlands16,319 websites
Germany15,740 websites
Brazil10,313 websites
Italy8,274 websites
Poland6,939 websites
Spain6,530 websites
GB6,409 websites

Website Distribution by TLD

Number of websites using CVE-2025-1220
.com129,116 websites
.ru47,667 websites
.fr46,173 websites
.org15,825 websites
.nl14,297 websites
.net11,468 websites
.com.br8,945 websites
.de7,500 websites
.be6,950 websites
.it6,739 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-1220

Top websites that are affected by CVE-2025-1220. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.space United States***
********.info United States***
********.org United States***
*********.com United States***
****************.com United States*,***
********.********.it Italy*,***
*****.pl Poland*,***
*******.com Germany*,***
*****************.com United States*,***
*******.com United States*,***
See full domain list

FAQ

CVE-2025-1220 is Server-Side Request Forgery (SSRF) in PHP
A total of 389,863 websites have been identified as vulnerable to CVE-2025-1220, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2025-1220 vulnerability.
PHP versions up to 8.4.10 are vulnerable to CVE-2025-1220.
CVE-2025-1220 is resolved in version 8.4.10 of PHP.