FILTER_VALIDATE_URL accepts URLs with invalid userinfo

...

AZL-42430 CVE-2024-5458 affecting package php for versions less than 8.1.29-1

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as filtervar when validating URLs FILTERVALIDATEURL for certain types of URLs the function will result in invalid user information username + password part of URLs being...

PHP Security Vulnerabilities

PHP is a scripting language that executes on the server side. A security vulnerability exists in PHP, which stems from a code logic error, where a filter function validating URLs incorrectly treats invalid user information containing username and password sections as valid user information for...