When DOM or SimpleXML load an HTTP resource that redirects, headers from every hop are kept, so the charset can come from the wrong response and documents may be misparsed or validation bypassed.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.4 | < 8.4.5 | 8.4.5 |
| PHP 8.3 | < 8.3.19 | 8.3.19 |
| PHP 8.2 | < 8.2.28 | 8.2.28 |
| PHP 8.1 | < 8.1.32 | 8.1.32 |
Older branches: not assessed
Exploitation conditions
No special conditions are documented.
Remediation
Upgrade to 8.1.32, 8.2.28, 8.3.19, 8.4.5 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 5.3 v3.1 | NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source