CVE-2026-7263
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Published:May 10, 2026
Last Modified:May 12, 2026
EPS:May 10, 2026
EPSS Score:0.00042
CVSS Score:7.5
Affected Products
Vendor
Product
Action
Vendor
Php
Product
Php
Php
Php
Vendor
Php Group
Product
Php
Php Group
Php
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
