CVE-2025-14181: PHP SOAP HTTP client heap buffer overflow in response parsing

CVE-2025-14181 · Severity: medium · CVSS 6.5 · Published 2026-09-25

PHP's SOAP client contains a flaw in how it processes chunked HTTP responses from SOAP servers. A malicious SOAP server or network attacker can exploit this to overflow a memory buffer, potentially crashing the application or corrupting memory. The vulnerability requires specific compiler optimizations and large responses to trigger, but when it does occur, it can have serious consequences for any PHP application using the SOAP client functionality.

Technologies: Php. Vendors: PHP.

Quick answers

Is CVE-2025-14181 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14181 being exploited in the wild.
How severe is CVE-2025-14181?
Medium severity, with a CVSS score of 6.5, published 25 September 2026.
Which products and versions are affected?
Php before 8.2.34, 8.3.x before 8.3.35, 8.4.x before 8.4.26, 8.5.x before 8.5.11.
Is there a fix for CVE-2025-14181?
A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14181 attacked?
It is attacked over the network.
Am I affected by CVE-2025-14181?
Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SOAP HTTP client in ext/soap/php_http.c uses a signed integer overflow check to guard buffer growth, which is undefined behavior and can be optimized away by modern compilers. A malicious SOAP server responding with chunked Transfer-Encoding (chunk sizes like 0x7fffffff) can cause the accumulated buffer size to overflow, resulting in undersized memory allocation followed by an out-of-bounds write. The vulnerability requires the client to accept multi-gigabyte responses and only manifests on compiler builds that discard the undefined overflow check.

Affected products

  • PHP PHP before 8.2.34, 8.3.x before 8.3.35, 8.4.x before 8.4.26, 8.5.x before 8.5.11

Timeline

  • 2026-09-25: disclosed
  • 2026-09-25: patched: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.