VULNERABILITY INTELLIGENCE
CVE-2026-7263
CVSS score6.3 MEDIUM
EPSS probability0.35%
CISA KEVNot currently listed
Published2026-05-10
Last modified2026-07-24
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber
Description
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Weakness classification
- CWE-404: Improper Resource Shutdown or Release
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')