Bug 2378690 (CVE-2025-6491)

Summary: CVE-2025-6491 php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gcovolo, jcadmus, ronald.l.gould
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability was found in PHP. If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-08 17:34:38 UTC 
If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.

Libxml versions prior to 2.13 cannot correctly handle a call to xmlNodeSetName() with a name longer than 2G. It will leave the node object in an invalid state with a NULL name. This later causes a NULL pointer dereference when using the name during message serialization.

This can be exploited if a SoapVar is created with a fully qualified name that is longer than 2G. This would be possible if some application code uses a namespace prefix from an untrusted source like from a remote SOAP service.
Comment 3 Ron Gould 2025-09-12 18:57:38 UTC 
CVE state is currently "Fix Deferred". Is there a plan to fix this for Red Hat 8.10 for DNF Module php:8.2?
Comment 5 errata-xmlrpc 2025-12-18 12:20:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:23309 https://access.redhat.com/errata/RHSA-2025:23309
Comment 6 Ron Gould 2025-12-18 15:14:53 UTC 
Will a fix be issued to Red Hat Enterprise Linux 8?