Skip to content
Heist/ feed
Back to feed
Medium

Filter bypass in filter_var (FILTER_VALIDATE_URL)

Type: advisorySources: OSV

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-5458
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:15 UTC · Revision 1

Source evidence

Filter bypass in filter_var (FILTER_VALIDATE_URL)

core-osv · Original source

Published 9 Jun 2024, 18:26 UTC

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

osv:CVE-2024-5458
Complete source record
{
  "id": "64582a8cb5b354db6fde9f70304c53af7bc74f18dcb7cb5b9ce31d046f397a07",
  "url": "https://osv.dev/vulnerability/CVE-2024-5458",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Filter bypass in filter_var (FILTER_VALIDATE_URL)",
    "summary": "In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.",
    "evidence": "osv:CVE-2024-5458",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-5458",
      "aliases": [
        "BIT-libphp-2024-5458",
        "BIT-php-2024-5458",
        "BIT-php-min-2024-5458",
        "CVE-2024-5458",
        "GHSA-w8qr-v226-r27w"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/php/php-src",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c800ecda065b5642dde6aff5484d58d91d77f66c"
                },
                {
                  "last_affected": "c796a801599b13943c2413589e339c39d1d4bb47"
                },
                {
                  "introduced": "c6723538054d96291abb6bad4628b9f55bc7fc17"
                },
                {
                  "last_affected": "dca8d5565b947270a29f232bc54efd9df3b92b94"
                },
                {
                  "introduced": "a66aeecc2c0adc32ea0bbaa6e669b92f2deaa939"
                },
                {
                  "last_affected": "8213daa932be1c2ae04726233e4e56e5df63980e"
                },
                {
                  "introduced": "381ba9f5d0edd0c9c8ec1dea7e21d513ad08b115"
                },
                {
                  "fixed": "fc4973fb0dfae6085742868b8f0f05163e150a0c"
                },
                {
                  "introduced": "70ee6c20ad97e02c2b8098aeea96fefbbc3ac5c2"
                },
                {
                  "fixed": "40298a988fca728ddc47316938da61e0f768c872"
                },
                {
                  "introduced": "d26068059e83fe40de3430a512471d194119bee0"
                },
                {
                  "fixed": "ce51bfac759dedac1537f4d5666dcd33fbc4a281"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "7.3.27"
                      },
                      {
                        "last_affected": "7.3.33"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "7.4.15"
                      },
                      {
                        "last_affected": "7.4.33"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "8.0.2"
                      },
                      {
                        "last_affected": "8.0.30"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "8.1.0"
                      },
                      {
                        "fixed": "8.1.29"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "8.2.0"
                      },
                      {
                        "fixed": "8.2.20"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "8.3.0"
                      },
                      {
                        "fixed": "8.3.8"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5458.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.837701431Z",
      "provider": "osv",
      "references": [
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00009.html",
        "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5458.json",
        "https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-5458",
        "https://security.netapp.com/advisory/ntap-20240726-0001/",
        "https://github.com/php/php-src"
      ],
      "provider_metadata": {
        "cna_assigner": "php",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5458.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-5458",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499917,
  "published_at": "2024-06-09T18:26:28.804+00:00"
}