CVE-2026-91765
published 2026-09-25CVE-2026-91765: cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.52%
43.1th percentile
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_8.4 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.34 | 8.2.34 |
| php_group | php | >= 8.3.* < 8.3.35 | 8.3.35 |
| php_group | php | >= 8.4.* < 8.4.26 | 8.4.26 |
| php_group | php | >= 8.5.* < 8.5.11 | 8.5.11 |
| ubuntu | php5 | — | — |
| ubuntu | php7.0 | — | — |
| ubuntu | php7.2 | — | — |
| ubuntu | php7.4 | — | — |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
vendor_ubuntu3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 SOAP XML Parser cleanup_xml_node recursion
vuldb·2026-09-25·CVSS 7.5
CVE-2026-91765 [HIGH] PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 SOAP XML Parser cleanup_xml_node recursion
A vulnerability classified as problematic has been found in PHP up to 8.2.33/8.3.34/8.4.25/8.5.10. Affected by this vulnerability is the function cleanup_xml_node of the component SOAP XML Parser. The manipulation leads to uncontrolled recursion.
This vulnerability is referenced as CVE-2026-91765. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 3.4
CVE-2026-93682 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP did not properly validate the size of MySQL
server packets in the mysqlnd driver. A malicious server could possibly use
this issue to cause PHP to crash, resulting in a denial of service. This
issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)
It was discovered that PHP incorrectly handled response buffer sizes in the
SOAP HTTP client. A malicious server could possibly use this issue to cause
PHP to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2025-14181)
It was discovered that PHP incorrectly handled certain TAR archive headers
in the Phar extension. An attacker could pos
Red Hat
php: php: Denial of Service via unbounded recursion in SOAP parser
vendor_redhat·2026-09-25·CVSS 7.5
CVE-2026-91765 [HIGH] CWE-770 php: php: Denial of Service via unbounded recursion in SOAP parser
php: php: Denial of Service via unbounded recursion in SOAP parser
A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted request to an affected Simple Object Access Protocol (SOAP) server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing such requests exhausts system stack memory and crashes the application process.
Package: php (Red Hat Enterprise Linux 10) - Affected
Package: php8.4 (Red Hat Enterprise Linux 10) - Affected
Package: php (Red Hat Enterprise Linux 6) - Affected
Package: php (Red Hat Enterprise Linux 7) - Affected
Package: php:7.4/php (Red Hat Enterprise Linux 8) - Affected
Package: php:8.2/php (Red Hat Enterprise Linux 8) - Affected
Package:
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
blogs_hackernews·2026-10-05·CVSS 7.5
CVE-2026-88779 [HIGH] ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook.
There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others are still getting in because the basics gave way first.
Here’s what mattered this week.
## ⚡ Threat of the Week
Citrix Warns of Ne
Bugzilla
CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser [fedora-all]
bugzilla·2026-09-30·CVSS 7.5
CVE-2026-91765 [HIGH] CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser [fedora-all]
CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Bugzilla
CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser
bugzilla·2026-09-25·CVSS 7.5
CVE-2026-91765 [HIGH] CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser
CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
2026-09-25
Published