CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
It was discovered that PHP incorrectly handled certain hostnames containing null characters. A remote attacker could possibly use this issue to bypass certain hostname validation checks. It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql escaping functions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. It was discovered that PHP incorrectly handled parsing certain XML data in SOAP extensions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2025-06-22 CVE Reserved
- 2025-07-12 CVE Published
- 2025-07-14 CVE Updated
- 2025-07-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (1)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.1.0 < 8.1.33 Search vendor "PHP Group" for product "PHP" and version " >= 8.1.0 < 8.1.33" | en |
Affected
| ||||||
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.2.0 < 8.2.29 Search vendor "PHP Group" for product "PHP" and version " >= 8.2.0 < 8.2.29" | en |
Affected
| ||||||
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.3.0 < 8.3.23 Search vendor "PHP Group" for product "PHP" and version " >= 8.3.0 < 8.3.23" | en |
Affected
| ||||||
| PHP Group Search vendor "PHP Group" | PHP Search vendor "PHP Group" for product "PHP" | >= 8.4.0 < 8.4.10 Search vendor "PHP Group" for product "PHP" and version " >= 8.4.0 < 8.4.10" | en |
Affected
| ||||||