CVE-2025-6491
published 2025-07-13CVE-2025-6491: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large…
PriorityP429medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.99%
60.3th percentile
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php7.4 7.4.33-1+deb11u9 (bullseye) | php7.4 7.4.33-1+deb11u9 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u9 (bullseye) | php7.4 7.4.33-1+deb11u9 (bullseye) |
| debian | php8.4 | < php7.4 7.4.33-1+deb11u9 (bullseye) | php7.4 7.4.33-1+deb11u9 (bullseye) |
| msrc | azl3_php_8.3.23-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.32-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.33-1_on_cbl_mariner_2.0 | — | — |
| php | php | >= 8.1.0 < 8.1.33 | 8.1.33 |
| php | php | >= 8.2.0 < 8.2.29 | 8.2.29 |
| php | php | >= 8.3.0 < 8.3.23 | 8.3.23 |
| php | php | >= 8.4.0 < 8.4.10 | 8.4.10 |
| php_group | php | >= 8.1.* < 8.1.33 | 8.1.33 |
| php_group | php | >= 8.2.* < 8.2.29 | 8.2.29 |
| php_group | php | >= 8.3.* < 8.3.23 | 8.3.23 |
| php_group | php | >= 8.4.* < 8.4.10 | 8.4.10 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP regression
vendor_ubuntu·2025-09-04·CVSS 3.7
CVE-2025-1735 [LOW] PHP regression
Title: PHP regression
Summary: USN-7648-2 introduced a regression in PHP
USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735
caused a regression in php7.0, php7.2 and php7.4. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-08-21·CVSS 3.7
CVE-2025-1220 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
USN-7648-1 fixed several vulnerabilities in PHP. This update
provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2025-07-17·CVSS 3.7
CVE-2025-1735 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to crash, resulting in a denial of service. (CVE-2025-6491)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
vendor_msrc·2025-07-08·CVSS 5.9
CVE-2025-6491 [MEDIUM] CWE-476 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Refere
Red Hat
php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
vendor_redhat·2025-07-05·CVSS 5.9
CVE-2025-6491 [MEDIUM] CWE-476 php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
A vulnerability was found in PHP. If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.
Mitigation: Currently, no mitigation is currently available for this vulnerability.
Package: php (Red Hat Enterprise Linux 10) - Fix deferred
Package: php (Red Hat Enterprise Linux 6) - Fix deferr
Debian
CVE-2025-6491: php7.4 - In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8...
vendor_debian·2025·CVSS 5.9
CVE-2025-6491 [MEDIUM] CVE-2025-6491: php7.4 - In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8...
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u9)
OSV
php7.0, php7.2, php7.4 regression
osv·2025-09-04·CVSS 5.3
CVE-2025-1735 [MEDIUM] php7.0, php7.2, php7.4 regression
php7.0, php7.2, php7.4 regression
USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735
caused a regression in php7.0, php7.2 and php7.4. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use thi
OSV
php7.0, php7.2, php7.4 vulnerabilities
osv·2025-08-21·CVSS 5.3
CVE-2025-1220 [MEDIUM] php7.0, php7.2, php7.4 vulnerabilities
php7.0, php7.2, php7.4 vulnerabilities
USN-7648-1 fixed several vulnerabilities in PHP. This update
provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to
OSV
php8.1, php8.3, php8.4 vulnerabilities
osv·2025-07-17·CVSS 5.3
CVE-2025-1220 [MEDIUM] php8.1, php8.3, php8.4 vulnerabilities
php8.1, php8.3, php8.4 vulnerabilities
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to crash, resulting in a denial of service. (CVE-2025-6491)
OSV
CVE-2025-6491: In PHP versions:8
osv·2025-07-13·CVSS 5.9
CVE-2025-6491 [MEDIUM] CVE-2025-6491: In PHP versions:8
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-13
Published