Skip to main content

PHP CVE-2026-7263

| EUVDEUVD-2026-28981 MEDIUM
Improper Resource Shutdown or Release (CWE-404)
2026-05-10 php
Denial Of Service PHP
6.3
CVSS 4.0 · Vendor: php
Share

Severity by source

Vendor (php) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (php).

CVSS VectorVendor: php

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
May 10, 2026 - 07:16 EUVD
Analysis Generated
May 10, 2026 - 06:30 vuln.today
CVSS changed
May 10, 2026 - 06:22 NVD
6.3 (MEDIUM)
CVE Published
May 10, 2026 - 04:43 nvd
MEDIUM 6.3

DescriptionCVE.org

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

AnalysisAI

The DOMNode::C14N() method in PHP 8.4.x before 8.4.21 and 8.5.x before 8.5.6 incorrectly processes XML data, creating circular linked lists in the document structure that trigger infinite loops during subsequent XML processing, causing denial of service. Unauthenticated remote attackers can trigger this by submitting malformed XML to applications using affected PHP versions, though attack complexity is noted as present in the CVSS vector.

Technical ContextAI

The vulnerability resides in PHP's DOM extension, specifically the C14N() (Canonicalization) method which is part of the W3C XML Canonicalization specification implementation. C14N is used to transform XML documents into a canonical form for digital signatures and comparisons. The underlying issue involves improper handling of XML node relationships during canonicalization, resulting in circular references in the internal linked-list data structure that represents the DOM tree. This violates the acyclic invariant expected by subsequent XML processing functions, causing them to enter infinite loops. The affected CPE (cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*) confirms this affects the core PHP runtime across all configurations.

RemediationAI

Vendor-released patches are available: upgrade to PHP 8.4.21 or later for PHP 8.4.x users, or upgrade to PHP 8.5.6 or later for PHP 8.5.x users. Review the GitHub security advisory at https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733 for detailed patch notes and confirmation. If immediate upgrade is not feasible, implement input validation to reject malformed or suspicious XML before passing it to DOMNode::C14N() - specifically, pre-validate XML against a schema and verify structural integrity. Alternatively, disable the C14N() method or XML canonicalization features if not essential to application functionality, or restrict XML input to trusted sources only via network access controls. Apply security updates to PHP as part of routine patch cycles, prioritizing this update if your application processes external XML (SOAP, XML-RPC, digital signatures). Monitor application logs for sudden spikes in CPU usage or hung processes, which may indicate successful exploitation.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-404 – Improper Resource Shutdown or Release

View all
CVE-2024-0546 HIGH POC
7.5
CVE-2018-8120 HIGH POC
7.0
CVE-2024-31611 CRITICAL POC
9.1
CVE-2025-1103 HIGH POC
7.1
CVE-2022-4066 HIGH POC
8.2
CVE-2025-5867 HIGH POC
8.0
CVE-2018-8410 HIGH POC
7.8
CVE-2026-38641 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Legacy 15 SP7 Fixed

Share

CVE-2026-7263 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy