Cloudanix VulnDB

CVE-2025-14181

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Sep 25, 2026

CISA due date

—

The record

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities