CVE-2026-7263

Name of the Vulnerable Software and Affected Versions PHP versions 8.4.0 through 8.4.20 PHP versions 8.5.0 through 8.5.5

Description The DOMNode::C14N() method may process XML data incorrectly, leading to the creation of a circular linked list within the data structure that represents the XML document. This flaw can cause subsequent processing of the document to enter an infinite loop, resulting in a denial of service for the application.

Recommendations Update PHP version 8.4.x to 8.4.21. Update PHP version 8.5.x to 8.5.6. As a temporary workaround, restrict the use of the DOMNode::C14N() method when processing untrusted XML data.