MEDIUMCVSS 5.9

CVE-2025-6491

CVE-2025-6491 updated by NVD

Modified: 2026-09-20
Sources: nvd

Summary

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PHP	php	[object Object], [object Object], [object Object], [object Object]	—

References

https://nvd.nist.gov/vuln/detail/CVE-2025-6491

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.