CVE-2025-6491

MEDIUM EPSS 56.6%

Published Jul 13, 202511mo ago · Modified Jun 17, 20261w ago

5.9 CVSS 3.1

Medium

Published Jul 13, 2025 11mo ago

Last Modified Jun 17, 2026 1w ago

Description

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

CVSS Details

Base Score

5.9

Exploitability

2.2

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

56.6% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 4

Vendor	Product	Version	Range
php	php	*	≥8.1.0 – <8.1.33
php	php	*	≥8.2.0 – <8.2.29
php	php	*	≥8.3.0 – <8.3.23
php	php	*	≥8.4.0 – <8.4.10

References 3

openwall.com http://www.openwall.com/lists/oss-security/2025/07/11/4
github.com https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x

ExploitVendor Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.