Vulnerability · Published Mar 30, 2025 · Assigned by php

CVE-2025-1219libxml streams use wrong content-type header when requesting a redirected resource

Medium 6.3

In plain English

A medium-severity security flaw in PHP from PHP Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9apcu-panel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:10php8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-bcmath8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-bcmath7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-bcmath8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-bcmath8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-bcmath8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-bcmath8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-bcmath8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-cli8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-cli8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-cli7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-cli8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-cli8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-cli8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-cli8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-common8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-common8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-common7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-common8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-common8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-common8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-common8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-dba8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-dba7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-dba8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-dba8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-dba8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-dba8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-dba8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-dbg8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-dbg8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-dbg7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-dbg8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-dbg8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-dbg8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-dbg8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-devel8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-devel8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-devel7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-devel8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-devel8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-devel8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-devel8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:10php-embedded8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-embedded7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-embedded8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-embedded8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-embedded8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-embedded8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-embedded8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-enchant8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-enchant8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-enchant7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-enchant8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-enchant8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-enchant8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-enchant8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-ffi8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-ffi8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-ffi7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-ffi8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-ffi8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-ffi8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-ffi8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-fpm8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-fpm7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-fpm8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-fpm8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-fpm8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-fpm8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-fpm8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-gd8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-gd8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-gd7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-gd8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-gd8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-gd8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-gd8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-gmp8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-gmp8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-gmp7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-gmp8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-gmp8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-gmp8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-gmp8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-intl8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-intl8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-intl7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-intl8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-intl8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-intl8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-intl8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:8php-json7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:10php-ldap8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-ldap8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-ldap7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-ldap8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-ldap8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-ldap8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-ldap8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:10php-mbstring8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-mbstring7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-mbstring8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-mbstring8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-mbstring8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-mbstring8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-mbstring8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:10php-mysqlnd8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-mysqlnd8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-mysqlnd7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-mysqlnd8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-mysqlnd8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-mysqlnd8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-mysqlnd8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:10php-odbc8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-odbc7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-odbc8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-odbc8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-odbc8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-odbc8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-odbc8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-opcache8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-opcache8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-opcache7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-opcache8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-opcache8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-opcache8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-opcache8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:10php-pdo8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-pdo7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:8php-pdo8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:9php-pdo8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-pdo8.0.30-3.el9_6ALSA-2025:7431
AlmaLinux:9php-pdo8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-pdo8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-redis66.1.0-2.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2025:15687
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2026:2470
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2026:2470
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2026:2470
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2025:7432
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2025:4263
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.6.0+151+5f31e576ALSA-2025:7418
AlmaLinux:10php-pgsql8.3.19-1.el10_0ALSA-2025:7489
AlmaLinux:8php-pgsql8.2.28-1.module_el8.10.0+4046+958a243aALSA-2025:15687
AlmaLinux:8php-pgsql7.4.33-3.module_el8.10.0+4114+3b36c618ALSA-2026:2470
AlmaLinux:9php-pgsql8.1.32-1.module_el9.5.0+156+9f1cd3fdALSA-2025:4263
AlmaLinux:9php-pgsql8.3.19-1.module_el9.6.0+166+f262c21cALSA-2025:7418
AlmaLinux:9php-pgsql8.2.28-1.module_el9.6.0+165+cf879a7cALSA-2025:7432
AlmaLinux:9php-pgsql8.0.30-3.el9_6ALSA-2025:7431

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.1.* – before 8.1.328.2.* – before 8.2.288.3.* – before 8.3.198.4.* – before 8.4.5

Weakness: CWE-1116 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References