CVE-2025-14180

A flaw was found in PHP. When the PDO (PHP Data Objects) PostgreSQL driver is configured with PDO::ATTR_EMULATE_PREPARES enabled, a remote attacker can exploit a vulnerability by providing an invalid character sequence within a prepared statement parameter. This can cause a null pointer dereference, leading to a server crash. The primary impact is a Denial of Service (DoS), affecting the availability of the target server.

This vulnerability is rated Important for Red Hat because it can lead to a Denial of Service in PHP applications utilizing the PDO PostgreSQL driver. Exploitation requires the PDO::ATTR_EMULATE_PREPARES option to be explicitly enabled, allowing a remote attacker to crash the server by providing a specially crafted invalid character sequence in a prepared statement parameter.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.