{"id":"BIT-libphp-2025-6491","summary":"NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix","details":"In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (\u003e2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.","aliases":["BIT-php-2025-6491","BIT-php-min-2025-6491","CVE-2025-6491"],"modified":"2026-03-16T03:12:31.352365Z","published":"2025-08-11T13:54:53.967Z","database_specific":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"severity":"Medium"},"references":[{"type":"WEB","url":"https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6491"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/07/11/4"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"}],"affected":[{"package":{"name":"libphp","ecosystem":"Bitnami","purl":"pkg:bitnami/libphp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libphp/BIT-libphp-2025-6491.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}],"schema_version":"1.7.5"}