blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2026-91765

HIGH 7.5 CVSS 3.1
Published
September 25, 2026
Last modified
October 23, 2026
NVD status
Analyzed
Reported by
security@php.net
Weakness
CWE-674
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Affected products and versions

  • PHP — From 8.2.0 (including) to 8.2.34 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.35 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.26 (excluding)
  • PHP — From 8.5.0 (including) to 8.5.11 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm Vendor Advisory, Exploit
  • nvd.nist.gov Official NVD record