CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
cleanupxmlnode() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
Other sources
Fixed (Unbounded recursion in server-side cleanupxmlnode()). (CVE-2026-91765)
— PHP
SOAP: Unbounded Recursion in Server-Side cleanupxmlnode
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Frequently Asked Questions
Which PHP release changelog documents the fix?
The fix is documented in the PHP 8.3.35 changelog.