CVE-2026-7263
DOMNode::C14N() Infinite Loop in PHP
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: PHP Group
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| php | php | to 8.4.21 (exc) |
| php | php | to 8.5.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7263 is a high-severity Denial of Service (DoS) vulnerability in PHP's ext-dom extension, specifically in the DOMNode::C14N() function.
The vulnerability occurs because of improper removal of an xmlns attribute from a doubly linked list, which creates a corrupt circular linked list in the XML data structure.
This circular linked list causes subsequent processing of the XML document to enter an infinite loop, potentially leading to system crashes or resource starvation.
The root cause is incorrect pointer manipulation during attribute removal, where a node's previous pointer is updated incorrectly instead of the previous node's next pointer, resulting in a persistent circular reference.
This flaw affects PHP versions before 8.4.21 and 8.5.6 and requires no privileges or user interaction to exploit, with the attack vector being network-based.
How can this vulnerability impact me? :
This vulnerability can cause denial of service in applications processing XML documents using the vulnerable PHP versions.
Specifically, the corrupted circular linked list can cause infinite loops or system crashes (segfaults), leading to resource starvation and unavailability of the affected application or service.
Since exploitation requires no privileges or user interaction and can be triggered remotely over the network, it poses a significant risk to availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the DOMNode::C14N() function in PHP's ext-dom extension causing infinite loops or crashes when processing certain XML data. Detection can focus on monitoring PHP applications for symptoms such as unexpected crashes, segfaults, or unusually high CPU usage during XML processing.
Since the vulnerability is triggered by malformed XML input causing a circular linked list, one detection approach is to test PHP versions before 8.4.21 and 8.5.6 by running scripts that invoke DOMNode::C14N() on crafted XML data designed to trigger the issue.
There are no specific commands provided in the resources to detect this vulnerability directly on a network or system.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade PHP to versions 8.4.21 or 8.5.6 or later, where the vulnerability has been patched.
Until the upgrade can be performed, consider limiting or sanitizing XML input to the DOMNode::C14N() function to prevent processing of maliciously crafted XML that could trigger the vulnerability.
Additionally, monitor application logs and resource usage to detect potential exploitation attempts and respond accordingly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a denial of service (DoS) condition by leading to infinite loops or system crashes in applications processing XML data with the affected PHP versions. Such availability disruptions can impact the reliability and uptime of systems handling sensitive data.
While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, denial of service vulnerabilities can indirectly affect compliance by causing service outages, which may violate availability requirements stipulated in these regulations.
However, there is no direct information provided about data confidentiality, integrity, or specific regulatory impacts related to this vulnerability.