1. Home
  2. CVE Database
  3. CVE-2026-7263
HIGH · 7.5

CVE-2026-7263

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML docum...

Vulnerability Description

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
PhpPhp>= 8.4.0, < 8.4.21

Related Weaknesses (CWE)

CWE-835CWE-404

References

FAQ

What is CVE-2026-7263?

CVE-2026-7263 is a vulnerability with a CVSS score of 7.5 (HIGH). In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML docum...

How severe is CVE-2026-7263?

CVE-2026-7263 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-7263?

Check the references section above for vendor advisories and patch information. Affected products include: Php Php.