CVE-2025-6491

Published: Jul 13, 2025Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: security@php.net (Secondary)

Description

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

Affected (4)

Products: Php: Php

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 8.1.0 to 8.1.33
Php Php	From 8.2.0 to 8.2.29
Php Php	From 8.3.0 to 8.3.23
Php Php	From 8.4.0 to 8.4.10

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (4)

https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x

Source: security@php.net

ExploitVendor Advisory

http://www.openwall.com/lists/oss-security/2025/07/11/4

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.