CVE-2026-91765

Denial of Service via unbounded recursion in SOAP parser

Publication Date 2026-09-25
Severity High
Type Denial of Service
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.33
  • 8.3.0-8.3.34
  • 8.4.0-8.4.25
  • 8.5.0-8.5.10
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.8

CVE Details

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Recommendations

Consider switching to a userland SOAP server implementation such as php-soap/engine and its ecosystem of libraries, as they address these vulnerabilities and release more frequently. If you cannot, and you provide a SoapServer service, update to a patched PHP version.