CVE-2025-6491: PHP SOAP Extension DoS Vulnerability

CVE-2025-6491 Overview

CVE-2025-6491 is a Null Pointer Dereference vulnerability affecting the SOAP extension in multiple PHP versions. When parsing XML data, overly large XML namespace prefixes exceeding 2GB can trigger a null pointer dereference condition. This vulnerability can lead to application crashes and denial of service, impacting the availability of PHP-based web servers and applications.

Critical Impact

Attackers can cause denial of service conditions by sending specially crafted SOAP requests with oversized XML namespace prefixes, crashing PHP applications and affecting server availability.

Affected Products

• PHP 8.1.* versions before 8.1.33
• PHP 8.2.* versions before 8.2.29
• PHP 8.3.* versions before 8.3.23
• PHP 8.4.* versions before 8.4.10

Discovery Timeline

• 2025-07-13 - CVE-2025-6491 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-6491

Vulnerability Analysis

This vulnerability exists within PHP's SOAP extension, specifically in the XML parsing functionality. The SOAP extension is commonly used in PHP applications for web service communication using XML-based messaging protocols. When the parser encounters an XML namespace prefix that exceeds 2GB in size, improper memory handling occurs, resulting in a null pointer dereference condition.

The vulnerability is classified under CWE-476 (NULL Pointer Dereference), indicating that the application attempts to use a pointer that it expects to be valid but is actually NULL. In this case, the oversized namespace prefix causes the parser to enter an unexpected state where memory references become invalid.

Root Cause

The root cause of CVE-2025-6491 lies in inadequate input validation and boundary checking when processing XML namespace prefixes within the SOAP extension. The parser does not properly validate the size of namespace prefix data before attempting to process it, leading to memory corruption when extremely large values are encountered. When the namespace prefix exceeds the 2GB threshold, internal data structures fail to properly allocate or reference memory, resulting in a null pointer being dereferenced during subsequent operations.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to send malicious SOAP requests to a vulnerable PHP application. The attack does not require authentication or user interaction, making it accessible to remote unauthenticated attackers. However, the attack complexity is considered high because:

1. The attacker must craft a SOAP request with an XML namespace prefix exceeding 2GB in size
2. The target application must use the PHP SOAP extension and process the malicious input
3. Network and server configurations may impose limits on request sizes that could prevent exploitation

The vulnerability specifically manifests when the SOAP extension processes XML data containing the oversized namespace prefix. An attacker would need to identify PHP applications using SOAP functionality and craft requests that bypass any existing input size restrictions.

Detection Methods for CVE-2025-6491

Indicators of Compromise

• Unexpected PHP process crashes or segmentation faults in application logs
• Abnormally large SOAP/XML requests in web server access logs (requests approaching or exceeding 2GB)
• Increased error rates or service unavailability on PHP-powered endpoints using SOAP
• Memory-related errors in PHP error logs when processing SOAP requests

Detection Strategies

• Monitor web application firewall (WAF) logs for unusually large XML payloads in SOAP requests
• Implement request size monitoring to detect anomalous traffic patterns targeting SOAP endpoints
• Configure application performance monitoring (APM) tools to alert on PHP process crashes
• Review PHP error logs for null pointer dereference or segmentation fault messages related to SOAP operations

Monitoring Recommendations

• Set up alerting for PHP-FPM or Apache/Nginx worker process crashes
• Monitor request payload sizes at the network perimeter and application layer
• Implement rate limiting and size restrictions on SOAP endpoints
• Enable verbose logging for SOAP extension operations during investigation periods

How to Mitigate CVE-2025-6491

Immediate Actions Required

• Upgrade PHP to patched versions: 8.1.33, 8.2.29, 8.3.23, or 8.4.10
• Implement request size limits at the web server level to prevent oversized payloads from reaching PHP
• Configure WAF rules to block abnormally large SOAP requests
• Consider temporarily disabling SOAP functionality if not critical and patching is delayed

Patch Information

PHP has released security patches addressing this vulnerability. Users should upgrade to the following minimum versions:

• PHP 8.1.x: Upgrade to 8.1.33 or later
• PHP 8.2.x: Upgrade to 8.2.29 or later
• PHP 8.3.x: Upgrade to 8.3.23 or later
• PHP 8.4.x: Upgrade to 8.4.10 or later

For detailed patch information, refer to the PHP GitHub Security Advisory. Additional security announcements are available via the OpenWall OSS Security mailing list and the Debian LTS Announcement.

Workarounds

• Configure web server request size limits (e.g., client_max_body_size in Nginx, LimitRequestBody in Apache) to prevent oversized requests
• Implement application-level input validation to reject SOAP requests with excessively large namespace prefixes
• Deploy network-level filtering to drop packets associated with abnormally large HTTP requests
• Use a reverse proxy with strict payload size enforcement in front of PHP applications

# Nginx configuration example - limit request body size
server {
    # Limit request body to 10MB to prevent oversized payloads
    client_max_body_size 10m;
    
    location /soap {
        # Additional restrictions for SOAP endpoints
        client_max_body_size 5m;
    }
}