CVE-2026-91765: PHP PHP vulnerability
Published Sep 24, 2026
·Updated
Fixed (Unbounded recursion in server-side cleanupxmlnode()). (CVE-2026-91765)
Affected Software
1 affected componentFixes available
PHP PHP<8.4.26
8.4.26
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26
Event History
Sep 24, 2026
CVE Published
via PHP·12:00 AM
Data Sourced
via PHP·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
Which PHP release changelog documents the fix?
The fix is documented in the PHP 8.3.35 changelog.