CVE-2026-91765CWE-674

CVE-2026-91765

High · published September 26, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-26T01:17Z
Affected products (4)
ProductVersionsFixed in
php/php≥ 8.2.0, < 8.2.348.2.34
php/php≥ 8.3.0, < 8.3.358.3.35
php/php≥ 8.4.0, < 8.4.268.4.26
php/php≥ 8.5.0, < 8.5.118.5.11
References (1)
https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm · [email protected]
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 1%
    epss
  • 25 SEP 20:33Z
    SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
    cvelistv5