CVE-2026-7263
DoS attack via DOMNode::C14N()
At a glance Severity MEDIUM 6.3 EPSS EPSS 0.35 % · percentile 29 (2026-10-27) State PUBLISHED Published 2026-05-10 Updated 2026-07-15 Assigner php NVD status Modified Description In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Scores Version Score Vector Scored by CVSS 4.0 MEDIUM 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber php CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H redhat-SADP CVSS 4.0 MEDIUM 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber NVD · security@php.net (Secondary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.21cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.6Affected products Product Versions PHP Group · PHP affected 8.4.* < 8.4.21 ; affected 8.5.* < 8.5.6
References
Sources
