PHP maintainers have released patches for a critical null pointer dereference vulnerability in the SOAP extension that lets remote attackers crash worker processes with a specially crafted XML payload. The flaw, tracked as CVE-2025-6491, affects all active PHP branches—8.1, 8.2, 8.3, and 8.4—and users are urged to upgrade to the latest versions immediately.

The mechanics of the crash

The vulnerability is triggered when an XML namespace prefix exceeds 2 gigabytes in length. That may sound absurdly large, but it’s a boundary an attacker can intentionally hit. When PHP’s SOAP extension parses or serializes a name containing such a prefix, the underlying libxml2 library (versions before 2.13) fails to handle the allocation correctly and leaves the node’s name pointer in a NULL state. Later, the SOAP serialization code calls a string comparison—strcmp—on that NULL pointer, causing an immediate segmentation fault and terminating the PHP worker process.

This is not a subtle race condition or a memory corruption that requires heap grooming. The crash is deterministic. A proof-of-concept demonstrates the attack by crafting a SoapVar with a qualified name containing a >2GB prefix and invoking a SoapClient call. In simple terms: send a malicious SOAP payload, crash the server.

Are you at risk?

Not every PHP installation is vulnerable, but the attack surface is broader than you might think. The SOAP extension (ext/soap) is not enabled by default in many PHP builds, yet it ships with common distributions and is often enabled when implementing or consuming web services. If your application uses SoapClient or SoapServer, or relies on any third-party library that does, you are exposed.

For home users and hobbyists running a development environment or a small site on shared hosting, the risk depends entirely on whether SOAP is active. Run php -m | grep soap from the command line or check phpinfo() to see if the extension is loaded. If you don’t need SOAP, disable it. If you do, patch immediately.

For power users and developers, the danger lies in custom applications and APIs. Microservices that communicate via SOAP, legacy enterprise integrations, or any system that parses XML from untrusted sources can be taken down by a single unauthenticated request. Even if you have rate limiting or request size limits, an attacker may find ways to split payloads or target internal endpoints that lack those protections.

For IT professionals and system administrators, the issue extends beyond individual servers. Containers, virtual machine images, and appliances may embed vulnerable PHP versions or static binaries that won’t be updated by running a simple apt upgrade. A hardened edge proxy might block oversized requests, but an attacker who reaches a backend service directly—or exploits another vulnerability to land on an internal network—can bypass those controls. Moreover, the crash terminates the worker process, and in a PHP-FPM pool with a small number of children, repeated attacks can exhaust the pool and lead to persistent outages.

A single, unauthenticated remote request is all it takes. The immediate impact is denial of service. While no public remote-code-execution exploit exists, any NULL pointer dereference is a memory-safety violation that should be treated seriously. History shows that seemingly limited bugs can combine with other weaknesses to enable more dangerous attacks.

Your upgrade playbook

The primary fix is to apply the upstream PHP updates. These are the safe versions for each currently supported branch:

  • PHP 8.1 → upgrade to 8.1.33 or later
  • PHP 8.2 → upgrade to 8.2.29 or later
  • PHP 8.3 → upgrade to 8.3.23 or later
  • PHP 8.4 → upgrade to 8.4.10 or later

If you use a Linux distribution’s package manager, look for security updates that incorporate these versions. For Windows, download the updated binaries from the PHP for Windows site (the patched builds match the version numbers above).

But patching the runtime is only the first step. You must also verify that your entire stack is clean:

  1. Check if SOAP is enabled on every host, container, and appliance. Remove it if it’s not essential—this is the most effective mitigation if your applications don’t require SOAP. For PHP-FPM, you can disable the extension in php.ini by commenting out extension=soap (or the corresponding line).
  2. Enforce strict request size limits at the edge. A >2GB namespace prefix cannot realistically be delivered in a single HTTP request if you cap body sizes to something like 100 MB. While this is a mitigation, not a fix, it raises the bar for attackers.
  3. Add Web Application Firewall (WAF) rules that inspect SOAP payloads for abnormally long namespace prefixes or qualified names. Tune these rules so they don’t break legitimate large messages.
  4. Isolate SOAP processing in dedicated worker processes with tight memory and CPU limits (using cgroups, ulimits, or process managers) so that a crash does not take down the entire service. Supervisors can restart workers without soaking all requests.

Protecting containers and images

Many PHP deployments today run in containers or as static binaries shipped in virtual appliances. Applying a host-level package update does nothing if the vulnerable runtime is baked into an image. Attackers routinely scan public registries for known-vulnerable images, and a compromised container can be leveraged to move laterally.

To close this blind spot:

  • Rebuild all container images from a patched base image. If you use an official PHP image from Docker Hub, pull the latest minors (e.g., php:8.2.29-fpm).
  • Scan your registries with a vulnerability scanner that detects CVE-2025-6491. Flag any image containing an affected PHP version and block it from production.
  • For appliances or vendor-supplied binaries, contact the vendor and ask for a patched release. Until then, restrict network access to those appliances and treat them as untrusted.
  • Update CI/CD pipelines to test for this vulnerability. Add a regression test that constructs a SOAP payload with a boundary-checked prefix, and ensure that the patched runtime rejects the input cleanly instead of crashing.

Looking ahead

CVE-2025-6491 is a stark reminder that even a single uncontrolled external input can become a high-severity operational risk. The fix is simple, and the vulnerability has not yet been reported as exploited in the wild, but the proof-of-concept is public. Defenders should act now, not wait for active scanning or attacks.

Patch your PHP installations, disable SOAP if unused, and rebuild your images. Then monitor for abnormal crash signatures—segfaults in PHP-FPM logs, sudden worker restarts, or spikes in HTTP 502 errors. Early detection buys you time to respond before a denial-of-service incident becomes a full outage.

PHP maintainers handled the disclosure cleanly, providing explicit version numbers and a safe PoC for testing. The remaining risk lies not in the patched code but in the supply chain—stale images, forgotten appliances, and build pipelines that reintroduce old binaries. Focus your efforts there, and you’ll be safe.