CVE-2026-7263

DoS attack via DOMNode::C14N()

CVSS 6.3 MEDIUMEPSS 0.3%CWE-404 CWE-835

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber

Affected products

PHP Group · PHP

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733