PT-2026-39458 · Php · Php

Ilija Tovilo + 1 · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-7263

NVD

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

Fix

Infinite Loop

Improper Resource Release

Weakness Enumeration

CWE-835

CWE-404

Related Identifiers

CVE-2026-7263

Affected Products

Php

References · 2

• https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7263 · Security Note