Is CVE-2026-7263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7263 being exploited in the wild.

How severe is CVE-2026-7263?

High severity, with a CVSS score of 7.5, published 10 May 2026.

Which products and versions are affected?

PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6; Red Hat Enterprise Linux AppStream 10.2.

Is there a fix for CVE-2026-7263?

A patch was published on 2026-06-02: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7263 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7263?

Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7263: PHP DOMNode::C14N() denial of service via circular linked list

CVE-2026-7263 · Severity: high · CVSS 7.5 · Published 2026-05-10

A vulnerability in PHP's XML processing component can be exploited to cause a denial-of-service (DoS) condition. By providing a specially crafted XML document, an attacker can trigger an infinite loop or a system crash (segmentation fault) in applications that process XML data. This can lead to service outages, high CPU usage, and the inability for the application to respond to legitimate users.

Technologies: PHP Group PHP, Red Hat Enterprise Linux AppStream. Vendors: PHP Group, Red Hat.

Quick answers

Is CVE-2026-7263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7263 being exploited in the wild.
How severe is CVE-2026-7263?: High severity, with a CVSS score of 7.5, published 10 May 2026.
Which products and versions are affected?: PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6; Red Hat Enterprise Linux AppStream 10.2.
Is there a fix for CVE-2026-7263?: A patch was published on 2026-06-02: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7263 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7263?: Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the DOMNode::C14N() method within PHP's ext-dom extension. The root cause is an improper removal of a 'xmlns' libxml2 attribute from a doubly linked list, where a pointer assignment error (attr->prev = attr->next instead of attr->prev->next = attr->next) results in a corrupt, circular linked list. When the application or libxml2 subsequently iterates through this list, it enters an infinite loop or triggers a segmentation fault. This can be exploited remotely without authentication if an application processes attacker-supplied XML data using the affected method. The issue is resolved in PHP versions 8.4.21 and 8.5.6.

Affected products

PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6
Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2

Timeline

2026-05-07: advisory: GitHub advisory published by PHP Group
2026-05-10: disclosed: CVE published to NVD
2026-06-02: patched: Red Hat released security updates for RHEL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.