CVE-2024-5458

Filter bypass in filter_var (FILTER_VALIDATE_URL)

MEDIUM

5.3

CVSS Score

Published: June 9, 2024 at 06:26 PM UTC

Updated: June 17, 2026 at 08:15 AM UTC

2 products affected across 2 vendorsFedoraPHP

Using PHP by PHP Group?

Get instant alerts when new vulnerabilities affect PHP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 12%

SSVC

PoC

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora · Fedora Projectrpm

95%

PHP · PHPdrupal

95%

7.3.27 ≤ v ≤ 7.3.337.4.15 ≤ v ≤ 7.4.338.0.2 ≤ v ≤ 8.0.308.1.* ≤ v < 8.1.298.1.0 ≤ v < 8.1.298.2.* ≤ v < 8.2.208.2.0 ≤ v < 8.2.208.3.* ≤ v < 8.3.88.3.0 ≤ v < 8.3.87.3.27 7.4.15 8.0.2 8.1.*8.1.0 8.2.*8.2.0 8.3.*8.3.0

Affected range stops below 8.1.29, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.2.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.3.8, so it looks safe — our inference, not a vendor statement