High 7.5 CVSS 3.1 PHP Published on 2026-09-25

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit.

CVECVE-2026-91765 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-10-23

Description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security@php.net · secondary

High 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

References

Vendor Advisorygithub.com
https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

PHP (29)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2026-109619 PHP has various global state that temporarily points into request memory. PHP Critical 9.2 ≥ 5.4.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No

CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. PHP Critical 9.8 ≥ 7.3.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No

CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP… PHP Critical 9.8 ≥ 8.4.0 < 8.4.24
≥ 8.5.0 < 8.5.9 2026-07-30 No

CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions… PHP Critical 9.8 ≥ 8.2.0 < 8.2.33
≥ 8.3.0 < 8.3.33
≥ 8.4.0 < 8.4.24
+1 2026-07-30 No

Does your server run PHP 8.2.x ≥ 8.2.0 < 8.2.34, 8.3.x ≥ 8.3.0 < 8.3.35, 8.4.x ≥ 8.4.0 < 8.4.26, 8.5.x ≥ 8.5.0 < 8.5.11?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected