Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-14181

Fixed in a distro release EPSS <1%CVSS 6.5

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

Published 2026-09-25 · CVE record · OSV

Products: PHP Group PHP

Distro releases

ReleasePackageFixed in
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-bcmath7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-cli7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-common7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-dba7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-dbg7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-devel7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-embedded7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-enchant7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-ffi7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-fpm7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-gd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-gmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-intl7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-json7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-ldap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-mbstring7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-mysqlnd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-odbc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-opcache7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-pdo7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pgsql7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-process7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-snmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-soap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-xml7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-xmlrpc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
Debian:12php8.28.2.34-1~deb12u1
Debian:13php8.48.4.26-1~deb13u1
Debian:14php8.48.4.26-1
Red Hat:hummingbird:1php0:8.5.11-2.hum1
Red Hat:hummingbird:1php-bcmath0:8.5.11-2.hum1
Red Hat:hummingbird:1php-cli0:8.5.11-2.hum1
Red Hat:hummingbird:1php-common0:8.5.11-2.hum1
Red Hat:hummingbird:1php-dba0:8.5.11-2.hum1
Red Hat:hummingbird:1php-dbg0:8.5.11-2.hum1
Red Hat:hummingbird:1php-devel0:8.5.11-2.hum1
Red Hat:hummingbird:1php-embedded0:8.5.11-2.hum1
Red Hat:hummingbird:1php-enchant0:8.5.11-2.hum1
Red Hat:hummingbird:1php-ffi0:8.5.11-2.hum1
Red Hat:hummingbird:1php-fpm0:8.5.11-2.hum1
Red Hat:hummingbird:1php-gd0:8.5.11-2.hum1
Red Hat:hummingbird:1php-gmp0:8.5.11-2.hum1
Red Hat:hummingbird:1php-intl0:8.5.11-2.hum1
Red Hat:hummingbird:1php-ldap0:8.5.11-2.hum1
Red Hat:hummingbird:1php-mbstring0:8.5.11-2.hum1
Red Hat:hummingbird:1php-mysqlnd0:8.5.11-2.hum1
Red Hat:hummingbird:1php-odbc0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo-dblib0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo-firebird0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pgsql0:8.5.11-2.hum1
Red Hat:hummingbird:1php-process0:8.5.11-2.hum1
Red Hat:hummingbird:1php-snmp0:8.5.11-2.hum1
Red Hat:hummingbird:1php-soap0:8.5.11-2.hum1
Red Hat:hummingbird:1php-sodium0:8.5.11-2.hum1
Red Hat:hummingbird:1php-tidy0:8.5.11-2.hum1
Red Hat:hummingbird:1php-xml0:8.5.11-2.hum1
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1912+72767185
Rocky Linux:8php0:7.4.33-8.module+el8.10.0+40393+c071e357
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1605+02e07af7
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.4.0+414+2e7afcdd
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Module for Legacy 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Legacy 15 SP7php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-embed7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-test7.4.33-150400.4.81.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7apache2-mod_php88.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php88.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-embed8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-fastcgi8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-fpm8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-test8.3.35-150700.3.21.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server 15 SP5-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server 15 SP6-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSapache2-mod_php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-embed8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-fastcgi8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-fpm8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-test8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 16.0apache2-mod_php88.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php88.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-embed8.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-fastcgi8.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-fpm8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-embed8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-fastcgi8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-fpm8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-test8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-mod_php88.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php88.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-embed8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-fastcgi8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-fpm8.4.26-160000.1.1
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.27
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.12
Ubuntu:26.04:LTSphp8.58.5.4-0ubuntu1.4
Ubuntu:26.10php8.58.5.9-0ubuntu2
Ubuntu:Pro:14.04:LTSphp55.5.9+dfsg-1ubuntu4.29+esm17
Ubuntu:Pro:16.04:LTSphp7.07.0.33-0ubuntu0.16.04.16+esm21
Ubuntu:Pro:18.04:LTSphp7.27.2.24-0ubuntu0.18.04.17+esm13
Ubuntu:Pro:20.04:LTSphp7.47.4.3-4ubuntu2.29+esm4
openSUSE:Leap 16.0apache2-mod_php88.4.26-160000.1.1
openSUSE:Leap 16.0php88.4.26-160000.1.1
openSUSE:Leap 16.0php8-embed8.4.26-160000.1.1
openSUSE:Leap 16.0php8-fastcgi8.4.26-160000.1.1
openSUSE:Leap 16.0php8-fpm8.4.26-160000.1.1
openSUSE:Leap 16.0php8-test8.4.26-160000.1.1
openSUSE:Tumbleweedphp88.5.11-1.1