CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.38 % · percentile 32 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- php
- NVD status
- Analyzed
Description
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Weaknesses (CWE)
- CWE-674 — Uncontrolled Recursion
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | php |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security@php.net (Secondary) |
European references
- ENISA EUVD · EUVD-2026-87355
- GCVE · GCVE-0-2026-91765
CERT-FR advisories
- CERTFR-2026-AVI-1227 — Multiples vulnérabilités dans PHP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.2.0 < 8.2.34cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.35cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.4.0 < 8.4.26cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 8.5.0 < 8.5.11
Affected products
| Product | Versions |
|---|---|
| PHP Group · PHP | affected 8.2.* < 8.2.34 ; affected 8.3.* < 8.3.35 ; affected 8.4.* < 8.4.26 ; affected 8.5.* < 8.5.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |