ext-soap vulnerabilities
CVEs whose affected-version data names the ext-soap package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-91765High· 7.5cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust th…
▾ TwilightPHP Group · ext-soapvia NVD
CVE-2025-14181Medium· 6.5PoCThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make…
▾ TwilightPHP Group · ext-soapvia NVD