CVE-2026-91765

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 0.52%
EPSS Percentile: 42.22%
CISA KEV: Not listed

Description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@php.net
Published: 26-Sep-2026 04:17
Last Modified: 30-Sep-2026 04:27
EPSS Date: 2026-10-11
CWE: CWE-674

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

References

security@php.net

Last enrichment sync: 12-Oct-2026 05:18
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

ADSelfService Plus), CVE-2026-75939 (Red Hat OpenShift), GHSA-632h-h47v-g4x4 (OpenCode), CVE-2026-91765 (PHP), CVE-2026-96760 (Authlib), CVE-2026-42542, CVE-2026-44639 (TDengine), CVE-2026-86553, Weekly Security Recap: Exploited Citrix NetScaler Flaw and Dozens of Vulnerabilities

CVE (135)

Vendors (1)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.