Innovate faster and cut risk with PHP experts from Zend Services.
Explore Services
See How Zend Helps Leading Hosting Providers Keep Their Managed Sites on Secure PHP
Read More
Learn PHP from PHP experts with free, on-demand, and instructor led courses.
Explore Training
Submit support requests and browse self-service resources.
Explore Support
CVE-2021-21702 php: NULL pointer dereference in SoapClient
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using the SOAP extension's SoapClient class to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash. This could lead to a Denial of Service.
If you are using the SoapClient in production, upgrade to 7.3.27 or later, 7.4.15 or later, or 8.0.2 or later. If you cannot upgrade, consider using a library such as phpro/soap-client, which does not use the SOAP extension.
Direct link to CVE-2021-21702 >
< View all CVEs