PHP 8.5 behavior change: header() removes headers by name prefix

[Artemeey]

Description

Fast example

php 8.4: https://php-play.dev/?c=DwfgDgFmBQ0QpgQwCbwE4AoDkiBcACARiwEoBuOJVTHAWgBd4Bneg48yldbPI0i6ADdEaAPrIArgFswGBFzRNRAGwCWLDCQ5A&v=8.4&f=console

php 8.5: https://php-play.dev/?c=DwfgDgFmBQ0QpgQwCbwE4AoDkiBcACARiwEoBuOJVTHAWgBd4Bneg48yldbPI0i6ADdEaAPrIArgFswGBFzRNRAGwCWLDCQ5A&v=8.5&f=console

Reproduction script

<?php

header('a: 1');
header('a-test: 1');
header('a: 1');

var_dump(headers_list());

Output (PHP 8.4.7, correct)

array(3) {
  [0]=>
  string(28) "X-Powered-By: PHP/8.4.17-dev"
  [1]=>
  string(9) "a-test: 1"
  [2]=>
  string(4) "a: 1"
}

Output (PHP 8.5.2, broken)

array(2) {
  [0]=>
  string(27) "X-Powered-By: PHP/8.5.2-dev"
  [1]=>
  string(4) "a: 1"
}

Problem statement

In PHP 8.5.x header() appears to remove previously set headers whose names share a prefix with the header being replaced. This differs from PHP 8.4.x behavior.

In the example below, replacing a (calling header('a: 1') twice) also removes a-test, despite a-test being a different header name.

Expected behavior

Replacing a header should affect only headers with the exact same name (a), not other headers (a-test) with a shared prefix.

Actual behavior

Replacing <base> also removes <base>-<suffix> headers.

Question

Is this an intended change in PHP 8.5 header handling?

PHP Version

PHP 8.4.7 (cli) (built: May 14 2025 18:01:53) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.7, Copyright (c) Zend Technologies

PHP 8.5.2 (cli) (built: Jan 21 2026 10:06:03) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.5.2, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.2, Copyright (c), by Zend Technologies

Operating System

Ubuntu 24.04

[iluuu1994]

Bisected to 18dee43. /cc @NattyNarwhal @bukka

[NattyNarwhal]

Yes, this is a regression. I'll take a look at this.

[NattyNarwhal]

GH-21020 ready, let me know if it works for you.