PHP SOAP Unbounded Recursion Crash (SOAP XML Parser)
CVE-2026-91765 Published on September 25, 2026

SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-91765 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2026-91765 has been classified to as a Stack Exhaustion vulnerability or weakness.


Products Associated with CVE-2026-91765

stack.watch emails you whenever new vulnerabilities are published in PHP or Php:php Php. Just hit a watch button to start following.

PHP
 
Php:php Php
 

Affected Versions

PHP Group PHP: