CVE-2025-6491

Published Jul 13, 2025

Last updated 2 months ago

PHP

SOAP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6491 affects the PHP SOAP extension. Creating a SoapVar instance with a fully qualified name exceeding 2GB can trigger a NULL pointer dereference, leading to a segmentation fault and process crash. This is due to limitations in libxml2 versions prior to 2.13, which cannot properly handle calls to xmlNodeSetName() with names longer than 2GB. Attackers could exploit this vulnerability by sending specially crafted SOAP requests, causing a denial-of-service condition. Any PHP application using the SOAP extension is at risk of being crashed by a remote attacker, leading to service disruption.

Description: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
Source: security@php.net
NVD status: Analyzed
Products: php

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.9
Impact score: 3.6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

security@php.net: CWE-476

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1DFFB7CE-0CB6-4229-8A83-D5994163F599",
            "versionEndExcluding": "8.1.33",
            "versionStartIncluding": "8.1.0"
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C0671DC7-C9E0-4CB9-8CBE-7C7D724A4E3F",
            "versionEndExcluding": "8.2.29",
            "versionStartIncluding": "8.2.0"
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "99142A2A-C510-477B-A090-DE73441BBFD0",
            "versionEndExcluding": "8.3.23",
            "versionStartIncluding": "8.3.0"
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "61D8A8DF-85D3-435B-BB2B-F3D728575758",
            "versionEndExcluding": "8.4.10",
            "versionStartIncluding": "8.4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.