NULL pointer dereference in PHP - CVE-2025-6491

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU112189

NULL pointer dereference in PHP - CVE-2025-6491

Published: July 4, 2025


Vulnerability identifier: #VU112189
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-6491
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the PHP SOAP extension. A remote attacker can pass a large XML namespace prefix to the application and perform a denial of service (DoS) attack.


Affected software

PHP
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for ARM 64
Ubuntu
openEuler
Fedora
SecurityCenter
EasyApache
libzip
libzip-devel
libzip-tools
php-pear
php-pecl-zip
php-pecl-rrd
php-pecl-xdebug
php-pecl-apcu
php-pecl-apcu-devel
apcu-panel
php7.0 (Ubuntu package)
php-intl
php-gd
php-json
php-ldap
php-mbstring
php-mysqlnd
php-odbc
php-opcache
php-pdo
php-xmlrpc
php-xml
php-pgsql
php-process
php-snmp
php-soap
php-fpm
php-ffi
php-enchant
php-embedded
php-devel
php-dbg
php-dba
php-gmp
php-common
php-cli
php-bcmath
php
php-sodium
php-tidy
php-help
php-debugsource
php-debuginfo
php8.1 (Ubuntu package)
php8.2 (Debian package)

How to mitigate CVE-2025-6491

Install updates from vendor's website.

PHP - addressed in versions 8.1.33, 8.2.29, 8.3.23, 8.4.10
SecurityCenter - update to SC-202508.1
EasyApache - update to 4 25-22
libzip - update to 1.6.1-1
libzip-devel - update to 1.6.1-1
libzip-tools - update to 1.6.1-1
php-pear - update to 1.10.13-1.0.1
php-pecl-zip - update to 1.18.2-1
php-pecl-rrd - update to 2.0.1-1
php-pecl-xdebug - update to 2.9.5-1
php-pecl-apcu - update to 5.1.18-1
php-pecl-apcu-devel - update to 5.1.18-1
apcu-panel - update to 5.1.18-1
php7.0 (Ubuntu package) - addressed in versions 7.0.33-0ubuntu0.16.04.16+esm16, 7.0.33-0ubuntu0.16.04.16+esm18, 7.2.24-0ubuntu0.18.04.17+esm9, 7.2.24-0ubuntu0.18.04.17+esm11, 7.4.3-4ubuntu2.29+esm1, 7.4.3-4ubuntu2.29+esm2
php-intl - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-gd - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-json - update to 7.4.33-3.0.1
php-ldap - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-mbstring - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-mysqlnd - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-odbc - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-opcache - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-pdo - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-xmlrpc - update to 7.4.33-3.0.1
php-xml - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-pgsql - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-process - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-snmp - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-soap - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-fpm - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-ffi - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-enchant - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-embedded - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-devel - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-dbg - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-dba - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-gmp - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-common - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-cli - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-bcmath - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php - addressed in versions 7.4.33-3.0.1, 8.3.19-2
php-pdo - addressed in versions 8.0.30-10, 8.3.23-1
php-dbg - addressed in versions 8.0.30-10, 8.3.23-1
php-snmp - addressed in versions 8.0.30-10, 8.3.23-1
php-process - addressed in versions 8.0.30-10, 8.3.23-1
php-pgsql - addressed in versions 8.0.30-10, 8.3.23-1
php-soap - addressed in versions 8.0.30-10, 8.3.23-1
php-opcache - addressed in versions 8.0.30-10, 8.3.23-1
php-odbc - addressed in versions 8.0.30-10, 8.3.23-1
php-mysqlnd - addressed in versions 8.0.30-10, 8.3.23-1
php-mbstring - addressed in versions 8.0.30-10, 8.3.23-1
php-ldap - addressed in versions 8.0.30-10, 8.3.23-1
php-intl - addressed in versions 8.0.30-10, 8.3.23-1
php-gmp - addressed in versions 8.0.30-10, 8.3.23-1
php-gd - addressed in versions 8.0.30-10, 8.3.23-1
php-fpm - addressed in versions 8.0.30-10, 8.3.23-1
php-sodium - addressed in versions 8.0.30-10, 8.3.23-1
php-tidy - addressed in versions 8.0.30-10, 8.3.23-1
php-xml - addressed in versions 8.0.30-10, 8.3.23-1
php-help - addressed in versions 8.0.30-10, 8.3.23-1
php-embedded - addressed in versions 8.0.30-10, 8.3.23-1
php-devel - addressed in versions 8.0.30-10, 8.3.23-1
php-debugsource - addressed in versions 8.0.30-10, 8.3.23-1
php-debuginfo - addressed in versions 8.0.30-10, 8.3.23-1
php-ffi - addressed in versions 8.0.30-10, 8.3.23-1
php-dba - addressed in versions 8.0.30-10, 8.3.23-1
php-common - addressed in versions 8.0.30-10, 8.3.23-1
php-cli - addressed in versions 8.0.30-10, 8.3.23-1
php-bcmath - addressed in versions 8.0.30-10, 8.3.23-1
php - addressed in versions 8.0.30-10, 8.3.23-1
php-enchant - addressed in versions 8.0.30-10, 8.3.23-1
php8.1 (Ubuntu package) - addressed in versions 8.1.2-1ubuntu2.22, 8.3.6-0ubuntu0.24.04.5, 8.4.5-1ubuntu1.1
php8.2 (Debian package) - update to 8.2.29-1~deb12u1
php-sodium - update to 8.3.19-2
php - addressed in versions 8.3.23-1.fc41, 8.4.10-1.fc42

External References

Related Security Bulletins