High severity · published Sep 25, 2026
CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
8.2.* before 8.2.34; 8.3.* before 8.3.35; 8.4.* before 8.4.26; 8.5.* before 8.5.11 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91765
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91765
vendor-advisory
https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability