CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
| CWE | CWE-674 |
| Vendor | php group |
| Product | php |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for php group php
Be the first to know when new high vulnerabilities affecting php group php are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
PHP Group / PHP
8.2.* < 8.2.34 8.3.* < 8.3.35 8.4.* < 8.4.26 8.5.* < 8.5.11
References
Credits
🔍 ExPatch_LLC Alexandre Daubois