CVE-2026-73321: XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and what access do they need?
An attacker needs an authenticated XenForo account with the ability to submit a post containing BBCode. No user interaction is required after the malicious post is submitted.
Which deployments are affected?
XenForo versions before 2.3.13 are affected. The issue is triggered when affected PHP-FPM workers render the thread containing the deeply nested BBCode.
What is the operational impact of a malicious post?
A sufficiently deeply nested BBCode post can exceed PHP's stack limit and cause fatal errors. PHP-FPM workers may repeatedly terminate for visitors rendering the affected thread, creating persistent denial of service.
How can administrators identify whether exploitation has occurred?
Investigate posts for unusually deep BBCode tag nesting and correlate them with PHP fatal errors or PHP-FPM worker terminations when the affected thread is rendered.
What should be done if immediate patching is not possible?
Remove or otherwise prevent rendering of posts containing deeply nested BBCode tags, particularly in threads associated with PHP fatal errors or PHP-FPM worker crashes. Upgrade to XenForo 2.3.13 when possible.