CVE-2025-6491: PHP SOAP Extension DoS Vulnerability

CVE-2025-6491 Overview

CVE-2025-6491 is a Null Pointer Dereference vulnerability affecting the SOAP extension in multiple PHP versions. When parsing XML data, overly large XML namespace prefixes exceeding 2GB can trigger a null pointer dereference condition. This vulnerability can lead to application crashes and denial of service, impacting the availability of PHP-based web servers and applications.

Critical Impact
Attackers can cause denial of service conditions by sending specially crafted SOAP requests with oversized XML namespace prefixes, crashing PHP applications and affecting server availability.

Affected Products

PHP 8.1.* versions before 8.1.33
PHP 8.2.* versions before 8.2.29
PHP 8.3.* versions before 8.3.23
PHP 8.4.* versions before 8.4.10

Discovery Timeline

2025-07-13 - CVE-2025-6491 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-6491

Vulnerability Analysis

This vulnerability exists within PHP's SOAP extension, specifically in the XML parsing functionality. The SOAP extension is commonly used in PHP applications for web service communication using XML-based messaging protocols. When the parser encounters an XML namespace prefix that exceeds 2GB in size, improper memory handling occurs, resulting in a null pointer dereference condition.

The vulnerability is classified under CWE-476 (NULL Pointer Dereference), indicating that the application attempts to use a pointer that it expects to be valid but is actually NULL. In this case, the oversized namespace prefix causes the parser to enter an unexpected state where memory references become invalid.

Root Cause

The root cause of CVE-2025-6491 lies in inadequate input validation and boundary checking when processing XML namespace prefixes within the SOAP extension. The parser does not properly validate the size of namespace prefix data before attempting to process it, leading to memory corruption when extremely large values are encountered. When the namespace prefix exceeds the 2GB threshold, internal data structures fail to properly allocate or reference memory, resulting in a null pointer being dereferenced during subsequent operations.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to send malicious SOAP requests to a vulnerable PHP application. The attack does not require authentication or user interaction, making it accessible to remote unauthenticated attackers. However, the attack complexity is considered high because:

The attacker must craft a SOAP request with an XML namespace prefix exceeding 2GB in size
The target application must use the PHP SOAP extension and process the malicious input
Network and server configurations may impose limits on request sizes that could prevent exploitation

The vulnerability specifically manifests when the SOAP extension processes XML data containing the oversized namespace prefix. An attacker would need to identify PHP applications using SOAP functionality and craft requests that bypass any existing input size restrictions.

Detection Methods for CVE-2025-6491

Indicators of Compromise

Unexpected PHP process crashes or segmentation faults in application logs
Abnormally large SOAP/XML requests in web server access logs (requests approaching or exceeding 2GB)
Increased error rates or service unavailability on PHP-powered endpoints using SOAP
Memory-related errors in PHP error logs when processing SOAP requests

Detection Strategies

Monitor web application firewall (WAF) logs for unusually large XML payloads in SOAP requests
Implement request size monitoring to detect anomalous traffic patterns targeting SOAP endpoints
Configure application performance monitoring (APM) tools to alert on PHP process crashes
Review PHP error logs for null pointer dereference or segmentation fault messages related to SOAP operations

Monitoring Recommendations

Set up alerting for PHP-FPM or Apache/Nginx worker process crashes
Monitor request payload sizes at the network perimeter and application layer
Implement rate limiting and size restrictions on SOAP endpoints
Enable verbose logging for SOAP extension operations during investigation periods

How to Mitigate CVE-2025-6491

Immediate Actions Required

Upgrade PHP to patched versions: 8.1.33, 8.2.29, 8.3.23, or 8.4.10
Implement request size limits at the web server level to prevent oversized payloads from reaching PHP
Configure WAF rules to block abnormally large SOAP requests
Consider temporarily disabling SOAP functionality if not critical and patching is delayed

Patch Information

PHP has released security patches addressing this vulnerability. Users should upgrade to the following minimum versions:

PHP 8.1.x: Upgrade to 8.1.33 or later
PHP 8.2.x: Upgrade to 8.2.29 or later
PHP 8.3.x: Upgrade to 8.3.23 or later
PHP 8.4.x: Upgrade to 8.4.10 or later

For detailed patch information, refer to the PHP GitHub Security Advisory. Additional security announcements are available via the OpenWall OSS Security mailing list and the Debian LTS Announcement.

Workarounds

Configure web server request size limits (e.g., client_max_body_size in Nginx, LimitRequestBody in Apache) to prevent oversized requests
Implement application-level input validation to reject SOAP requests with excessively large namespace prefixes
Deploy network-level filtering to drop packets associated with abnormally large HTTP requests
Use a reverse proxy with strict payload size enforcement in front of PHP applications

bash

# Nginx configuration example - limit request body size
server {
    # Limit request body to 10MB to prevent oversized payloads
    client_max_body_size 10m;
    
    location /soap {
        # Additional restrictions for SOAP endpoints
        client_max_body_size 5m;
    }
}