[php-src] Issue #21018: PHP 8.5 behavior change: header() removes headers by name prefix
[email protected] (Artemeey)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/21018
Author: Artemeey
### Description
## Fast example
php 8.4: https://php-play.dev/?c=DwfgDgFmBQ0QpgQwCbwE4AoDkiBcACARiwEoBuOJVTHAWgBd4Bneg48yldbPI0i6ADdEaAPrIArgFswGBFzRNRAGwCWLDCQ5A&v=8.4&f=console
php 8.5: https://php-play.dev/?c=DwfgDgFmBQ0QpgQwCbwE4AoDkiBcACARiwEoBuOJVTHAWgBd4Bneg48yldbPI0i6ADdEaAPrIArgFswGBFzRNRAGwCWLDCQ5A&v=8.5&f=console
## Reproduction script
```php
<?php
header('a: 1');
header('a-test: 1');
header('a: 1');
var_dump(headers_list());
```
## Output (PHP 8.4.7, correct)
```php
array(3) {
[0]=>
string(28) "X-Powered-By: PHP/8.4.17-dev"
[1]=>
string(9) "a-test: 1"
[2]=>
string(4) "a: 1"
}
```
## Output (PHP 8.5.2, broken)
```php
array(2) {
[0]=>
string(27) "X-Powered-By: PHP/8.5.2-dev"
[1]=>
string(4) "a: 1"
}
```
## Problem statement
In PHP 8.5.x `header()` appears to remove previously set headers whose names share a prefix with the header being replaced. This differs from PHP 8.4.x behavior.
In the example below, replacing `a` (calling `header('a: 1')` twice) also removes `a-test`, despite `a-test` being a different header name.
## Expected behavior
Replacing a header should affect only headers with the **exact same name** (`a`), not other headers (`a-test`) with a shared prefix.
## Actual behavior
Replacing `<base>` also removes `<base>-<suffix>` headers.
## Question
Is this an intended change in PHP 8.5 header handling?
### PHP Version
```plain
PHP 8.4.7 (cli) (built: May 14 2025 18:01:53) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.7, Copyright (c) Zend Technologies
PHP 8.5.2 (cli) (built: Jan 21 2026 10:06:03) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.5.2, Copyright (c) Zend Technologies
with Zend OPcache v8.5.2, Copyright (c), by Zend Technologies
```
### Operating System
Ubuntu 24.04