DoS attack via DOMNode::C14N()
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-7263US | high7.5 | — | ||
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure repres… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2026:22649WEB
- https://access.redhat.com/security/cve/CVE-2026-7263WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2468572WEB
- https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-7263WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.jsonWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan