CVE-2026-7263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7263
Aliases
Downstream
ALPINE (1)
ALSA (1)
BELL (1)
DEBIAN (1)
MINI (2)
openSUSE (2)
RHSA (1)
RLSA (1)
SUSE (1)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (1)
Published
2026-05-10T04:43:04Z
Modified
2026-11-11T02:56:06Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber CVSS Calculator
Summary
DoS attack via DOMNode::C14N()
Details

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-404",
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7263.json"
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
b437f2b32eb364c9496d24abcc734272e5c9c980
Fixed
7a64ae0507799547fbbd39b067bd3dd2c35e8fec
Introduced
685e99655ae97c667950f7f7d176985958718f56
Fixed
fcc29c8d6d6ee6f5ba2d941f0a2a6ea6aa6ee633
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.4.0"
                },
                {
                    "fixed": "8.4.21"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.6"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7263.json"