- CVE-2025-1736: the http:// stream wrapper suppressed its own User-Agent, Host, From, Authorization, Content-Length and Content-Type headers whenever it found the corresponding name in the caller's "header" context option, and it accepted a match preceded by any of CR, LF, TAB or space. A header *value* carrying a bare LF (or a tab or space) followed by e.g. "host:" therefore convinced php_stream_url_wrap_http_ex() in ext/standard/http_fopen_wrapper.c that the caller had already supplied that header, and PHP silently left its own out - most notably dropping the Basic-auth Authorization header derived from the URL userinfo. The six have_header probes now go through upstream's check_has_header() helper and require a full CRLF boundary before the match, as upstream 963551715a does. The helper walks every occurrence of the header name rather than only the first (upstream d0d60503b5, bug #79265): requiring CRLF without that loop would let a decoy occurrence earlier in the blob shadow the caller's real header and make PHP emit a duplicate Host, Content-Length or Authorization. The seventh, otherwise identical, probe in the "remove Proxy-Authorization header" block is left untouched on purpose: it gates a removal, so a stricter predicate there would be fail-open and would replay the proxy credential to the origin. Carries the three upstream GHSA regression tests plus upstream's bug79265.phpt and bug79265_2.phpt