CVE-2025-1735: PHP pgsql/pdo_pgsql DOS Vulnerability

CVE-2025-1735 Overview

A denial of service vulnerability has been identified in PHP's PostgreSQL database extensions (pgsql and pdo_pgsql). The escaping functions in these extensions fail to properly check if the underlying quoting functions returned errors. When a PostgreSQL server rejects a string as invalid, this unchecked error condition can cause the PHP application to crash, resulting in service disruption.

Critical Impact

Attackers can exploit this vulnerability remotely to crash PHP applications that interact with PostgreSQL databases by sending specially crafted invalid strings, leading to denial of service conditions.

Affected Products

• PHP 8.1.* versions before 8.1.33
• PHP 8.2.* versions before 8.2.29
• PHP 8.3.* versions before 8.3.23
• PHP 8.4.* versions (check for latest patched version)

Discovery Timeline

• 2025-07-13 - CVE-2025-1735 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-1735

Vulnerability Analysis

This vulnerability exists in PHP's PostgreSQL-related escaping functions within both the pgsql and pdo_pgsql extensions. When these extensions call the underlying PostgreSQL library's quoting functions to escape user-supplied strings, they do not verify whether the quoting operation completed successfully or returned an error.

PostgreSQL servers perform validation on incoming strings and may reject certain malformed or invalid character sequences. When such a rejection occurs at the database level, the quoting function returns an error state. Because PHP's escaping functions do not check for this error condition, the application continues execution with an invalid or undefined state, ultimately leading to a crash.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), as the root cause relates to the improper handling of string escaping operations in the context of SQL query construction.

Root Cause

The root cause of this vulnerability is the absence of error checking after calls to PostgreSQL's internal quoting functions. The PHP pgsql and pdo_pgsql extensions assume that string quoting operations will always succeed, but the PostgreSQL server can reject strings containing invalid byte sequences or malformed encoding. When this rejection occurs, the escaping functions return error states that PHP does not handle, resulting in undefined behavior and application crashes.

Attack Vector

This vulnerability can be exploited remotely over a network. An attacker can send specially crafted input strings to a PHP application that uses PostgreSQL database connections. When the application attempts to escape these malformed strings using the vulnerable functions, and the PostgreSQL server rejects them as invalid, the PHP process crashes.

The attack requires no authentication or user interaction, making it particularly dangerous for publicly accessible web applications. The attacker only needs the ability to submit input that will be processed by the vulnerable escaping functions.

The vulnerability mechanism involves the following sequence: when a PHP application receives user input and passes it through pgsql or pdo_pgsql escaping functions before database queries, the underlying PostgreSQL client library attempts to validate and quote the string. If the PostgreSQL server determines the string is invalid (for example, due to encoding issues), it returns an error. The PHP extension fails to check for this error and continues processing, causing the application to crash.

Detection Methods for CVE-2025-1735

Indicators of Compromise

• Unexpected PHP process crashes in applications using PostgreSQL databases
• Repeated segmentation faults or fatal errors in web server error logs
• Sudden application unavailability correlated with specific user input patterns
• Error log entries indicating PostgreSQL connection or escaping failures

Detection Strategies

• Monitor web application logs for PHP fatal errors occurring in database-related code paths
• Implement application-level monitoring to detect crash patterns in PostgreSQL-connected services
• Use Web Application Firewall (WAF) rules to identify and block malformed string injection attempts
• Deploy process monitoring to alert on unexpected PHP worker restarts or crashes

Monitoring Recommendations

• Enable verbose error logging for PHP applications using PostgreSQL extensions
• Set up alerting thresholds for PHP process restart frequency
• Monitor PostgreSQL server logs for rejected string validation errors
• Implement health checks that can detect application instability

How to Mitigate CVE-2025-1735

Immediate Actions Required

• Upgrade PHP to patched versions: 8.1.33, 8.2.29, 8.3.23, or the latest 8.4.x release
• Review and validate all user input before passing to PostgreSQL escaping functions
• Implement input encoding validation at the application layer
• Consider temporary rate limiting on endpoints that process user-supplied database input

Patch Information

PHP has released security updates to address this vulnerability. Organizations should update to the following minimum versions:

• PHP 8.1 branch: Update to 8.1.33 or later
• PHP 8.2 branch: Update to 8.2.29 or later
• PHP 8.3 branch: Update to 8.3.23 or later
• PHP 8.4 branch: Check the GitHub Security Advisory for the latest patched version

Additional security information is available through the OpenWall OSS Security Notice and the Debian LTS Announcement.

Workarounds

• Implement strict input validation to reject strings with potentially problematic encoding before they reach database functions
• Add try-catch exception handling around database escaping operations to gracefully handle failures
• Use parameterized queries and prepared statements as an alternative to string escaping where possible
• Consider deploying a reverse proxy with input sanitization capabilities as a temporary protective measure

# Check current PHP version and pgsql extension status
php -v
php -m | grep -E "(pgsql|pdo_pgsql)"

# Verify patched version after upgrade
php -r "echo 'PHP Version: ' . PHP_VERSION . PHP_EOL;"