CVE-2025-6491

CVE-2025-6491 affects the PHP SOAP extension. Creating a SoapVar instance with a fully qualified name exceeding 2GB can trigger a NULL pointer dereference, leading to a segmentation fault and process crash. This is due to limitations in libxml2 versions prior to 2.13, which cannot properly handle calls to xmlNodeSetName() with names longer than 2GB. Attackers could exploit this vulnerability by sending specially crafted SOAP requests, causing a denial-of-service condition. Any PHP application using the SOAP extension is at risk of being crashed by a remote attacker, leading to service disruption.