CVE-2025-14181

A flaw was found in PHP. A malicious server can cause a Denial of Service (DoS) by exploiting an improper buffer size check in the Simple Object Access Protocol (SOAP) client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer calculation issue, causing the client to allocate an undersized memory buffer. As the client writes incoming data past the allocated space, a heap-based buffer overflow occurs, leading to an application crash or potential memory corruption.

This vulnerability is rated Moderate because a malicious SOAP server can trigger unreliable buffer-size checks in PHP's SOAP HTTP client, leading to a heap buffer overflow that primarily causes denial of service and may allow limited memory corruption. Attack complexity is high because the overflow depends on compiler behavior and very large responses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Set a conservative PHP memory_limit so oversized SOAP responses fail before overflow conditions are reached. Restrict SoapClient endpoints to trusted servers over TLS and isolate SOAP traffic.