CVE-2025-1219: libxml streams use wrong content-type header when requesting a redirected resource
Fixed (libxml streams use wrong content-type header when requesting a redirected resource). (CVE-2025-1219)
Other sources
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1219?
CVE-2025-1219 has a moderate severity level due to its potential impact on content-type headers in redirected requests.
How do I fix CVE-2025-1219?
To mitigate CVE-2025-1219, upgrade PHP to version 8.3.19 or later.
What does CVE-2025-1219 affect?
CVE-2025-1219 affects PHP versions prior to 8.3.19 that improperly handle content-type headers in libxml streams.
Is CVE-2025-1219 a remote attack vulnerability?
Yes, CVE-2025-1219 could potentially be exploited in a remote attack scenario if an attacker controls redirection.
What are the potential consequences of CVE-2025-1219?
The consequences of CVE-2025-1219 include the possibility of content manipulation and exposure to data integrity issues.