CVE-2025-14181
published 2026-09-25CVE-2025-14181: The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed…
PriorityP340medium6.5CVSS 3.1
AVNACHPRNUINSUCNILAH
EPSS
0.31%
23.8th percentile
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| devspaces | code-rhel9 | — | — |
| php | php | — | — |
| php | php | >= 8.2.0 < 8.2.34 | 8.2.34 |
| php | php | >= 8.3.0 < 8.3.35 | 8.3.35 |
| php | php | >= 8.4.0 < 8.4.26 | 8.4.26 |
| php | php | >= 8.5.0 < 8.5.11 | 8.5.11 |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_8.4 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.34 | 8.2.34 |
| php_group | php | >= 8.3.* < 8.3.35 | 8.3.35 |
| php_group | php | >= 8.4.* < 8.4.26 | 8.4.26 |
| php_group | php | >= 8.5.* < 8.5.11 | 8.5.11 |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| ubuntu | php5 | — | — |
| ubuntu | php7.0 | — | — |
| ubuntu | php7.2 | — | — |
| ubuntu | php7.4 | — | — |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
vendor_redhat6.5MEDIUM
vendor_ubuntu3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 3.4
CVE-2026-93682 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP did not properly validate the size of MySQL
server packets in the mysqlnd driver. A malicious server could possibly use
this issue to cause PHP to crash, resulting in a denial of service. This
issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)
It was discovered that PHP incorrectly handled response buffer sizes in the
SOAP HTTP client. A malicious server could possibly use this issue to cause
PHP to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2025-14181)
It was discovered that PHP incorrectly handled certain TAR archive headers
in the Phar extension. An attacker could pos
Red Hat
php: PHP: Denial of Service via heap buffer overflow in SOAP client
vendor_redhat·2026-09-25·CVSS 6.5
CVE-2025-14181 [MEDIUM] CWE-787 php: PHP: Denial of Service via heap buffer overflow in SOAP client
php: PHP: Denial of Service via heap buffer overflow in SOAP client
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
A flaw was found in PHP. A malicious server can cause a Denial of Service (DoS) by exploiting an improper buffer size check in the Simple Object Access Protocol (SOAP) client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer calculation issue, causing the client to allocate an undersized memory buffer. As th
VulDB
PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 SOAP HTTP Client integer overflow
vuldb·2026-09-25·CVSS 6.5
CVE-2025-14181 [MEDIUM] PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 SOAP HTTP Client integer overflow
A vulnerability described as critical has been identified in PHP up to 8.2.33/8.3.34/8.4.25/8.5.10. Affected is an unknown function of the component SOAP HTTP Client. Executing a manipulation can lead to integer overflow.
The identification of this vulnerability is CVE-2025-14181. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-14181 php: PHP: Denial of Service via heap buffer overflow in SOAP client [fedora-all]
bugzilla·2026-10-14·CVSS 6.5
CVE-2025-14181 [MEDIUM] CVE-2025-14181 php: PHP: Denial of Service via heap buffer overflow in SOAP client [fedora-all]
CVE-2025-14181 php: PHP: Denial of Service via heap buffer overflow in SOAP client [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
Bugzilla
CVE-2025-14181 php: PHP: Denial of Service via heap buffer overflow in SOAP client
bugzilla·2026-09-25·CVSS 6.5
CVE-2025-14181 [MEDIUM] CVE-2025-14181 php: PHP: Denial of Service via heap buffer overflow in SOAP client
CVE-2025-14181 php: PHP: Denial of Service via heap buffer overflow in SOAP client
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
2026-09-25
Published