CVE-2026-91765 — HIGH (7.5)

Vulnerability Description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Related Weaknesses (CWE)

CWE-674

References

https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm

FAQ

What is CVE-2026-91765?

CVE-2026-91765 is a vulnerability with a CVSS score of 7.5 (HIGH). cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements t...

How severe is CVE-2026-91765?

CVE-2026-91765 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-91765?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.