Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-6491

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

Published

2025-07-13T22:15:23.353

Last Modified

2025-11-04T22:16:43.147

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

Weaknesses

Type: Secondary
CWE-476

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	php	php	< 8.1.33	Yes
Application	php	php	< 8.2.29	Yes
Application	php	php	< 8.3.23	Yes
Application	php	php	< 8.4.10	Yes

References

https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x Exploit, Vendor Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2025/07/11/4 (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x Exploit, Vendor Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)