CVE-2026-7263CWE-404CWE-835

DoS attack via DOMNode::C14N()

Medium · published May 10, 2026

CVSS v4.0
6.3
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber
EPSS
0.00630 · 49.5th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-05-10T04:43Z
EPSS history
Timeline
  • 10 MAY 04:43Z
    DoS attack via DOMNode::C14N()
    cvelistv5