Vulnerability · Published May 10, 2026 · Assigned by php
CVE-2026-7263DoS attack via DOMNode::C14N()
High 7.5
In plain English
A high-severity infinite loop in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | php8.4 | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-bcmath | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-cli | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-common | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-dba | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-dbg | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-devel | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-embedded | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-enchant | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-ffi | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-fpm | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-gd | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-gmp | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-intl | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-ldap | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-mbstring | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-mysqlnd | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-odbc | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-opcache | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-pdo | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-pgsql | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-process | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-snmp | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-soap | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| AlmaLinux:10 | php8.4-xml | 8.4.21-1.el10_2 | ALSA-2026:22649 |
| Alpine:v3.22 | php84 | 8.4.27-r0 | ALPINE-CVE-2026-7263 |
| Alpine:v3.23 | php84 | 8.4.21-r0 | ALPINE-CVE-2026-7263 |
| Alpine:v3.23 | php85 | 8.5.6-r0 | ALPINE-CVE-2026-7263 |
| Alpine:v3.24 | php85 | 8.5.6-r0 | ALPINE-CVE-2026-7263 |
| Debian:13 | php8.4 | 8.4.21-1~deb13u1 | DEBIAN-CVE-2026-7263 |
| Debian:14 | php8.4 | 8.4.21-1 | DEBIAN-CVE-2026-7263 |
| Rocky Linux:10 | php8.4 | 0:8.4.21-1.el10_2 | RLSA-2026:22649 |
| Ubuntu:26.04:LTS | php8.5 | 8.5.4-0ubuntu1.1 | UBUNTU-CVE-2026-7263 |
Affected products (as reported)
Weakness: CWE-404, CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-7263 vdb-entry, x_refsource_REDHAT
- RHBZ#2468572 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22649 vendor-advisory, x_refsource_REDHAT