CVE-2026-7263: DoS attack via DOMNode::C14N()
Fixed and (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)
Other sources
In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.6 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.31-1~deb12u1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.21-1~deb13u1Fixed in 8.4.21-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.5.6
Event History
Frequently Asked Questions
What is CVE-2026-7263?
CVE-2026-7263 is a vulnerability in PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6 that allows a Denial of Service (DoS) attack via the DOMNode::C14N() method.
What is the severity of CVE-2026-7263?
The severity of CVE-2026-7263 is classified as high due to its potential to cause service disruption.
How do I fix CVE-2026-7263?
To fix CVE-2026-7263, you should upgrade to PHP version 8.5.6 or higher.
Which PHP versions are affected by CVE-2026-7263?
PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6 are affected by CVE-2026-7263.
What type of attack does CVE-2026-7263 enable?
CVE-2026-7263 enables a Denial of Service (DoS) attack by causing incorrect processing of XML data.