High severity7.5NVD Advisory· Published Sep 25, 2026· Updated Oct 23, 2026

CVE-2026-91765

Description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHPllm-create2 versions
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=8.2.0,<8.2.34
osv-coords67 versions
pkg:rpm/almalinux/php-embedded pkg:bitnami/php pkg:rpm/almalinux/php8.4-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php8.4-gmp pkg:rpm/almalinux/php8.4-process pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php8.4-odbc pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php8.4 pkg:rpm/almalinux/php8.4-mbstring pkg:rpm/almalinux/php-pecl-rrd pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php8.4-dba pkg:rpm/almalinux/php8.4-enchant pkg:rpm/almalinux/php8.4-embedded pkg:rpm/almalinux/php8.4-fpm pkg:rpm/almalinux/php8.4-pdo pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php8.4-devel pkg:rpm/almalinux/php8.4-ffi pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-cli pkg:bitnami/libphp pkg:rpm/almalinux/php8.4-bcmath pkg:rpm/almalinux/php-json pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/php-ffi pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php8.4-cli pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php-pecl-xdebug pkg:rpm/almalinux/php-xmlrpc pkg:bitnami/php-min pkg:rpm/almalinux/php8.4-soap pkg:rpm/almalinux/php8.4-dbg pkg:rpm/almalinux/php8.4-ldap pkg:rpm/almalinux/php8.4-gd pkg:rpm/almalinux/php8.4-opcache pkg:rpm/almalinux/php8.4-pgsql pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed pkg:rpm/almalinux/php8.4-mysqlnd pkg:rpm/almalinux/php8.4-snmp pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-pecl-xdebug3 pkg:rpm/almalinux/php-pecl-redis6 pkg:rpm/almalinux/php8.4-intl pkg:rpm/almalinux/apcu-panel
< 8.3.36-1.el10_2+ 66 more
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: >= 8.2.0, < 8.2.34
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 5.1.23-1.module_el9.4.0+65+49ff6472
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 1.22.3-1.module_el9.4.0+65+49ff6472
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 2.0.3-4.module_el9.4.0+65+49ff6472
- (no CPE)range: < 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: >= 8.2.0, < 8.2.34
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 7.4.33-8.module_el8.10.0+4321+cf5fd4bb
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 5.1.23-1.module_el9.4.0+65+49ff6472
- (no CPE)range: < 1.7.3-1.module_el8.10.0+3796+30ed3ef7
- (no CPE)range: < 2.9.5-1.module_el8.6.0+3239+bedf0508
- (no CPE)range: < 7.4.33-8.module_el8.10.0+4321+cf5fd4bb
- (no CPE)range: >= 8.2.0, < 8.2.34
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.5.11-1.1
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 8.3.36-1.el10_2
- (no CPE)range: < 3.2.2-2.module_el9.4.0+65+49ff6472
- (no CPE)range: < 6.1.0-3.module_el9.8.0+257+89d727f2
- (no CPE)range: < 8.4.27-1.el10_2
- (no CPE)range: < 5.1.23-1.module_el9.4.0+65+49ff6472

Patches

Vulnerability mechanics

References

github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rmnvdVendor AdvisoryExploit

News mentions

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
The Hacker News · Oct 5, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000