CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Summary
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Original description
The description as published by the source.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-6491 php7.4 Fixed in: 7.4.33-1+deb11u9
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web openwall.com
- web lists.debian.org