CVE-2026-91765

CVE Details

Release Date:	2026-09-25
Impact:	Important	What is this?

Description

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

See more information about CVE-2026-91765 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.5
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (php)	ELSA-2026-87070	2026-10-21
Oracle Linux version 10 (php8.4)	ELSA-2026-87071	2026-10-21
Oracle Linux version 8 (libzip)	ELSA-2026-87080	2026-10-21
Oracle Linux version 8 (php)	ELSA-2026-87080	2026-10-21
Oracle Linux version 8 (php-pear)	ELSA-2026-87080	2026-10-21
Oracle Linux version 8 (php-pecl-apcu)	ELSA-2026-87080	2026-10-21
Oracle Linux version 8 (php-pecl-rrd)	ELSA-2026-87080	2026-10-21
Oracle Linux version 8 (php-pecl-xdebug)	ELSA-2026-87080	2026-10-21
Oracle Linux version 8 (php-pecl-zip)	ELSA-2026-87080	2026-10-21
Oracle Linux version 9 (php)	ELSA-2026-87151	2026-10-21