PT-2026-39458 · Php+2 · Php+2

Ilija Tovilo + 1 · Published 2026-05-10 · Updated 2026-05-28 · CVE-2026-7263

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5

Description The DOMNode::C14N() method may process XML data incorrectly, leading to the creation of a circular linked list within the data structure that represents the XML document. This flaw can cause subsequent processing of the document to enter an infinite loop, resulting in a denial of service for the application.

Recommendations Update PHP version 8.4.x to 8.4.21. Update PHP version 8.5.x to 8.5.6. As a temporary workaround, restrict the use of the DOMNode::C14N() method when processing untrusted XML data.

Fix

DoS

Infinite Loop

Improper Resource Release

Weakness Enumeration

CWE-835

CWE-404

Related Identifiers

BIT-LIBPHP-2026-7263

BIT-PHP-2026-7263

BIT-PHP-MIN-2026-7263

CVE-2026-7263

OPENSUSE-SU-2026:10747-1

USN-8336-1

Affected Products

Linuxmint

Php

Ubuntu

References · 38

• https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14179 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6104 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6722 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6735 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7262 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7263 · Security Note
• https://osv.dev/vulnerability/BIT-php-min-2026-7263 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8336-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/732066 · Security Note
• https://ubuntu.com/security/CVE-2026-7261 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-7263 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-7263 · Security Note