vulnerability

Ubuntu: (Multiple Advisories) (CVE-2025-6491): PHP vulnerabilities

Try Surface Command
Back to search
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:N/I:N/A:C)
Published
Jul 13, 2025
Added
Jul 18, 2025
Modified
Apr 16, 2026

Description

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

Solutions

ubuntu-pro-upgrade-php7-0ubuntu-pro-upgrade-php7-0-cgiubuntu-pro-upgrade-php7-0-cliubuntu-pro-upgrade-php7-0-fpmubuntu-pro-upgrade-php7-0-pgsqlubuntu-pro-upgrade-php7-2ubuntu-pro-upgrade-php7-2-cgiubuntu-pro-upgrade-php7-2-cliubuntu-pro-upgrade-php7-2-fpmubuntu-pro-upgrade-php7-2-pgsqlubuntu-pro-upgrade-php7-4ubuntu-pro-upgrade-php7-4-cgiubuntu-pro-upgrade-php7-4-cliubuntu-pro-upgrade-php7-4-fpmubuntu-pro-upgrade-php7-4-pgsqlubuntu-upgrade-libapache2-mod-php7-4ubuntu-upgrade-libapache2-mod-php8-0ubuntu-upgrade-libapache2-mod-php8-1ubuntu-upgrade-libapache2-mod-php8-3ubuntu-upgrade-libapache2-mod-php8-4ubuntu-upgrade-php8-1ubuntu-upgrade-php8-1-cgiubuntu-upgrade-php8-1-cliubuntu-upgrade-php8-1-fpmubuntu-upgrade-php8-1-pgsqlubuntu-upgrade-php8-3ubuntu-upgrade-php8-3-cgiubuntu-upgrade-php8-3-cliubuntu-upgrade-php8-3-fpmubuntu-upgrade-php8-3-pgsqlubuntu-upgrade-php8-4ubuntu-upgrade-php8-4-cgiubuntu-upgrade-php8-4-cliubuntu-upgrade-php8-4-fpmubuntu-upgrade-php8-4-pgsql

References

Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report