DEBIAN-CVE-2026-7263

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-7263

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-7263.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-7263

Upstream

CVE-2026-7263

Published

2026-05-10T06:16:08Z

Modified

2026-09-14T17:03:52Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

References

https://security-tracker.debian.org/tracker/CVE-2026-7263

Affected packages

Debian:13 / php8.4

Package

Name: php8.4
Purl: pkg:deb/debian/php8.4?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.4.21-1~deb13u1

Affected versions

8.*

8.4.11-1

8.4.16-1~deb13u1

8.4.16-1

8.4.20-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-7263.json"

Debian:14 / php8.4