CVE-2026-7263
DoS attack via DOMNode::C14N()
En bref Sévérité MEDIUM 6.3 EPSS EPSS 0.35 % · centile 29 (2026-10-27) État PUBLISHED Publiée 2026-05-10 Mise à jour 2026-07-15 Attribuée par php Statut NVD Modified Description In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Scores Version Score Vecteur Évalué par CVSS 4.0 MEDIUM 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber php CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H redhat-SADP CVSS 4.0 MEDIUM 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber NVD · security@php.net (Secondary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.21cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.6Produits affectés Produit Versions PHP Group · PHP affected 8.4.* < 8.4.21 ; affected 8.5.* < 8.5.6
Références
Sources
