Vulnerability · Published Sep 25, 2026 · Assigned by php

CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

High 7.5

In plain English

A high-severity security flaw in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 68.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:87072
AlmaLinux:9apcu-panel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:87079
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:87080
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:87080
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:87080
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:10php8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-bcmath8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-bcmath7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-bcmath8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-bcmath8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-bcmath8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-cli8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-cli7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-cli8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-cli8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-cli8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-common8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-common8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-common7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-common8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-common8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-dba8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-dba8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-dba7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-dba8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-dba8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-dbg8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-dbg7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-dbg8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-dbg8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-dbg8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-devel8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-devel7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-devel8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-devel8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-devel8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-embedded8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-embedded7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-embedded8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-embedded8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-embedded8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-enchant8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-enchant7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-enchant8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-enchant8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-enchant8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-ffi8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-ffi8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-ffi7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-ffi8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-ffi8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-fpm8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-fpm7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-fpm8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-fpm8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-fpm8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-gd8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-gd7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-gd8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-gd8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-gd8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-gmp8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-gmp8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-gmp7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-gmp8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-gmp8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:10php-intl8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-intl7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-intl8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-intl8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:9php-intl8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:8php-json7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:10php-ldap8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-ldap7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-ldap8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-ldap8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-ldap8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-mbstring8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-mbstring8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-mbstring7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-mbstring8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-mbstring8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-mysqlnd8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-mysqlnd8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-mysqlnd7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-mysqlnd8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-mysqlnd8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-odbc8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-odbc7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-odbc8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-odbc8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-odbc8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-opcache8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-opcache7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-opcache8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-opcache8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-opcache8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-pdo8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-pdo7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-pdo8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-pdo8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-pdo8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:87072
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:87079
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.8.0+287+a9a5bb73ALSA-2026:87079
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2026:87072
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.6.0+151+5f31e576ALSA-2026:87079
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.8.0+287+a9a5bb73ALSA-2026:87079
AlmaLinux:9php-pecl-redis66.1.0-3.module_el9.8.0+257+89d727f2ALSA-2026:87079
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508ALSA-2026:87080
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.6.0+151+5f31e576ALSA-2026:87079
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2026:87072
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.8.0+287+a9a5bb73ALSA-2026:87079
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2026:87080
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2026:87072
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.8.0+287+a9a5bb73ALSA-2026:87079
AlmaLinux:9php-pecl-xdebug33.3.1-1.module_el9.6.0+151+5f31e576ALSA-2026:87079
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2026:87080
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2026:87080
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2026:87080
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2026:87073
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.8.0+287+a9a5bb73ALSA-2026:87079
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.6.0+151+5f31e576ALSA-2026:87079
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2026:87072
AlmaLinux:10php-pgsql8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-pgsql8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-pgsql7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-pgsql8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-pgsql8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-process8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-process8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-process7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-process8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-process8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-snmp8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-snmp7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-snmp8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-snmp8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-snmp8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-soap8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-soap7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:8php-soap8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:9php-soap8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-soap8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:10php-xml8.3.36-1.el10_2ALSA-2026:87070
AlmaLinux:8php-xml8.2.35-1.module_el8.10.0+4323+fc907035ALSA-2026:87073
AlmaLinux:8php-xml7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:9php-xml8.0.30-8.el9_8.1ALSA-2026:87151
AlmaLinux:9php-xml8.3.36-1.module_el9.8.0+330+fdc30075ALSA-2026:87079
AlmaLinux:8php-xmlrpc7.4.33-8.module_el8.10.0+4321+cf5fd4bbALSA-2026:87080
AlmaLinux:10php8.48.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-bcmath8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-cli8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-common8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-dba8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-dbg8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-devel8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-embedded8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-enchant8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-ffi8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-fpm8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-gd8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-gmp8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-intl8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-ldap8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-mbstring8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-mysqlnd8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-odbc8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-opcache8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-pdo8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-pgsql8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-process8.4.27-1.el10_2ALSA-2026:87071
AlmaLinux:10php8.4-snmp8.4.27-1.el10_2ALSA-2026:87071

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.2.* – before 8.2.348.3.* – before 8.3.358.4.* – before 8.4.268.5.* – before 8.5.11

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References