- Description
- cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
- Source
- security@php.net
- NVD status
- Analyzed
- Products
- php
CVSS 3.1
- Type
- Secondary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity
- HIGH
- security@php.net
- CWE-674
- Hype score
- Not currently trending
Hi @Plesk VAPT identified vulnerabilities in PHP 8.2.x, 8.3.x, 8.4.x and 8.5.x (CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682). What is the recommended mitigation/update procedure for Plesk
@RawaleMayur
28 Sept 2026
35 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Hi @cPanel , VAPT identified vulnerabilities in PHP 8.2.x, 8.3.x, 8.4.x and 8.5.x (CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682). What is the recommended cPanel/EasyApache 4 mitigation or update procedure?
@RawaleMayur
28 Sept 2026
39 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
PHP 8.2.34・8.3.35・8.4.26・8.5.11で11件の脆弱性を修正-SOAPのCVE-2026-91765はCVSS 7.5 https://t.co/Fu1ElaGuRk #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
@securityLab_jp
27 Sept 2026
127 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AAFB3643-4D71-46ED-8184-DDE5FE41CD02",
"versionEndExcluding": "8.2.34",
"versionStartIncluding": "8.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FF664EE8-D417-45A4-84DF-158F5073FDE8",
"versionEndExcluding": "8.3.35",
"versionStartIncluding": "8.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52D4BECA-EF0D-4180-837C-AEFA7A12D243",
"versionEndExcluding": "8.4.26",
"versionStartIncluding": "8.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "308803C0-9FC8-40D2-8920-B83BCC48014F",
"versionEndExcluding": "8.5.11",
"versionStartIncluding": "8.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]