CVE-2026-73321CWE-674

CVE-2026-73321

Medium · published September 8, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00614 · 48.8th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-08T18:17Z
Affected products (1)
ProductVersionsFixed in
xenforo/xenforo< 2.3.132.3.13
References (5)
https://bombobombone.github.io/posts/cve-2026-73321/ · [email protected]https://github.com/BomboBombone/CVE-2026-73321 · [email protected]https://www.vulncheck.com/advisories/xenforo-uncontrolled-recursion-dos-via-bbcode-parser · [email protected]https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ · [email protected]https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 13:20Z
    XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
    cvelistv5