CVE-2026-91765
PHP: denial of service
- Risk score
- 74/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP val…
- Affected
- PHP
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: php
References
Original description
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Last activity 25 Sep 2026. Patch Forecast updates every hour.