What’s Vulnerable › Vulnerabilities

CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-23
• Weakness: CWE-190

Description

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

Affected products

• PHP: from 8.2.0 before 8.2.34; from 8.3.0 before 8.3.35; from 8.4.0 before 8.4.26; from 8.5.0 before 8.5.11 — fixed in 8.2.34, 8.3.35, 8.4.26, 8.5.11

How to fix

Upgrade to a fixed version: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11. Check the vendor advisory for mitigations.

References

• https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv
• https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv

Get alerted when CVE-2025-14181 or the next vulnerability affects your stack