CVE-2026-73321

Analyzed Analyzed - Analysis Complete

XenForo 2.3.13 Uncontrolled Recursion in BBCode Parser

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: VulnCheck

Description

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73321

Affected Vendors & Products

Vendor	Product	Version / Range
xenforo	xenforo	to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion flaw in XenForo's BBCode parser before version 2.3.13. Attackers can submit a post with deeply nested BBCode tags to cause a stack overflow in PHP, crashing PHP-FPM workers for all users viewing the affected thread. The issue stems from the parser not enforcing nesting limits before processing, allowing excessive recursion depth.

Detection Guidance

Monitor for repeated PHP-FPM worker crashes or stack overflow errors in logs when users access threads with deeply nested BBCode tags. Check web server logs for requests containing excessive [quote] tags or similar nested structures. Use tools like grep to search for patterns like '[quote]...[/quote]' with high nesting depth in post content.

Impact Analysis

If exploited, this vulnerability can cause persistent denial of service. Visitors to a forum thread containing the malicious post may experience crashes or errors due to PHP-FPM workers terminating. The attack can temporarily exhaust the worker pool if multiple requests are sent simultaneously, though the pool recovers once requests stop.

Mitigation Strategies

Upgrade XenForo to version 2.3.13 or later immediately. If upgrading is not possible, implement a web application firewall rule to block requests containing deeply nested BBCode tags or excessive tag repetition. Temporarily disable BBCode parsing in public posts until patched.

Hi! I’m here to help you understand CVE-2026-73321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70