CVE-2021-21702

—

CVSS 3.1

7.5 high

EPSS

3%p87

Published

Feb 15, 2021 (Feb 15, 2021)

Modified

Jun 17, 2026

Description

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

Vendors: php debian netapp oracle
Products: php, debian linux, clustered data ontap, communications diameter signaling router
Weakness: CWE-476
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news0 stories

No ingested article mentions this CVE yet.