Description
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PHP Group PHP
Default version status: unaffected
8.2.* to < 8.2.34affected8.3.* to < 8.3.35affected8.4.* to < 8.4.26affected8.5.* to < 8.5.11affected