PHP CVE-2026-91765

Exploitation requires an application built on the affected PHP version to pass attacker-controlled input to the vulnerable recursive routine (component not identified because the CVE description was not provided). CVSS marks it network-reachable, unauthenticated, and low-complexity with no user interaction, so default exposure is plausible; however the true reachability depends on whether the affected parser/function processes untrusted remote input in a given deployment. Limiting factors: impact is confined to availability (worker/process crash) with no data exposure or code execution, and mitigation is straightforward once the specific PHP fixed version is applied. The exact affected/fixed PHP versions must be confirmed from GHSA-rgrp-mwpx-f6rm.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is availability - consistent with CWE-674 (Uncontrolled Recursion), i.e. deep/recursive input driving stack exhaustion and process/worker crash (a denial-of-service condition), NOT confidentiality or integrity loss. This directly contradicts the input Tag 'Information Disclosure,' which is incompatible with C:N/I:N/A:H and CWE-674; treat the tag as mislabeled. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. No SSVC decision data was supplied. Net: this is a genuine availability/DoS bug in a ubiquitous product (PHP), which raises real-world relevance, but the 7.5 'High' score reflects a single availability impact rather than a code-execution or data-exposure risk. CRITICAL CAVEAT: the CVE description was not provided ('[Unknown description]'), so the exact vulnerable PHP component, the input that triggers the recursion, and the affected/fixed versions are UNKNOWN and could not be verified from the GHSA advisory (fetch was not permitted). The AV:N assumption should be validated against the actual advisory, since some recursion bugs are only reachable when the application feeds attacker-controlled data to the affected parser.

A remote, unauthenticated attacker submits crafted, deeply nested or self-referential input to a PHP application that passes it to the affected parsing/processing routine, driving uncontrolled recursion until the stack is exhausted and the PHP process or worker crashes. Repeating the request denies service to legitimate users. No public proof-of-concept was identified in the provided data.