Executive brief
A vulnerability in PHP's XML processing component can be exploited to cause a denial-of-service (DoS) condition. By providing a specially crafted XML document, an attacker can trigger an infinite loop or a system crash (segmentation fault) in applications that process XML data. This can lead to service outages, high CPU usage, and the inability for the application to respond to legitimate users.
Technical details
A vulnerability exists in the DOMNode::C14N() method within PHP's ext-dom extension. The root cause is an improper removal of a 'xmlns' libxml2 attribute from a doubly linked list, where a pointer assignment error (attr->prev = attr->next instead of attr->prev->next = attr->next) results in a corrupt, circular linked list. When the application or libxml2 subsequently iterates through this list, it enters an infinite loop or triggers a segmentation fault. This can be exploited remotely without authentication if an application processes attacker-supplied XML data using the affected method. The issue is resolved in PHP versions 8.4.21 and 8.5.6.
Affected products
- PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2
Timeline
- 2026-05-07: advisory: GitHub advisory published by PHP Group
- 2026-05-10: disclosed: CVE published to NVD
- 2026-06-02: patched: Red Hat released security updates for RHEL 10