HIGH 7.5 NVD

CVE-2026-91765

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containin

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Remediation

$ sudo apt install --only-upgrade php8.4

References

https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm

Published: 2026-09-25 · Source: NVD · Feed updated: 2026-09-25

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-09-25 via NVD. A remediation command is available below.

vulnfeed aggregates 11568 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.