Critical Vulnerability in PHP Packages: Null Pointer Dereference Due to XML Namespace Prefix
Summary
UBUNTU-CVE-2025-6491: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected packages include various versions of PHP (5.5, 7.0, 7.2, 7.4, 8.1, 8.2, 8.3, and 8.4) that are vulnerable to a critical issue when parsing XML data in SOAP extensions, specifically related to overly large XML namespace prefixes.
Vulnerability Detail
In PHP versions 8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, and 8.4.* before 8.4.10, a vulnerability exists that allows for a null pointer dereference when parsing XML data in SOAP extensions. This issue arises from the handling of excessively large XML namespace prefixes (greater than 2GB), which can lead to server crashes and affect the availability of the target server. The vulnerability is classified with a CVSS score of 5.9, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the size of XML namespace prefixes in their applications or avoid using excessively large XML data until the packages are updated. Additionally, disabling SOAP extensions may mitigate the risk, but this may affect application functionality.
Conclusion
The vulnerability in PHP packages poses a significant risk due to potential server crashes caused by null pointer dereference when handling large XML namespace prefixes. It is essential for users to update their PHP installations to the latest patched versions to mitigate this risk effectively.
See every vulnerability recorded for php5 →
FAQ
The vulnerability is a null pointer dereference caused by overly large XML namespace prefixes in PHP's SOAP extensions, which can lead to server crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as limiting XML namespace sizes or disabling SOAP extensions temporarily.
While the primary risk is server availability, it is advisable to back up data regularly to prevent potential data loss during crashes.
Detailed information can be found in the official security notices and vulnerability databases, including the CVE-2025-6491 entry.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
