# CVE-2026-7263: PHP DOMNode::C14N() denial of service via circular linked list

Source: https://junglewise.ai/threats/cve-2026-7263-php-domnode-c14n-denial-of-service-via-circular-linked-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-7263 · Severity: high · CVSS 7.5 · Published 2026-05-10

A vulnerability in PHP's XML processing component can be exploited to cause a denial-of-service (DoS) condition. By providing a specially crafted XML document, an attacker can trigger an infinite loop or a system crash (segmentation fault) in applications that process XML data. This can lead to service outages, high CPU usage, and the inability for the application to respond to legitimate users.

Technologies: [PHP Group PHP](https://junglewise.ai/threats/technologies/php), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [PHP Group](https://junglewise.ai/threats/vendors/php-group), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-7263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7263 being exploited in the wild.

**How severe is CVE-2026-7263?** High severity, with a CVSS score of 7.5, published 10 May 2026.

**Which products and versions are affected?** PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6; Red Hat Enterprise Linux AppStream 10.2.

**Is there a fix for CVE-2026-7263?** A patch was published on 2026-06-02: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7263 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7263?** Check whether you run PHP Group PHP or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the DOMNode::C14N() method within PHP's ext-dom extension. The root cause is an improper removal of a 'xmlns' libxml2 attribute from a doubly linked list, where a pointer assignment error (attr->prev = attr->next instead of attr->prev->next = attr->next) results in a corrupt, circular linked list. When the application or libxml2 subsequently iterates through this list, it enters an infinite loop or triggers a segmentation fault. This can be exploited remotely without authentication if an application processes attacker-supplied XML data using the affected method. The issue is resolved in PHP versions 8.4.21 and 8.5.6.

## Affected products

- PHP Group PHP 8.4.* before 8.4.21, 8.5.* before 8.5.6
- Red Hat Red Hat Enterprise Linux AppStream (v. 10) 10.2

## Timeline

- 2026-05-07: advisory: GitHub advisory published by PHP Group
- 2026-05-10: disclosed: CVE published to NVD
- 2026-06-02: patched: Red Hat released security updates for RHEL 10

## References

- [https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733)
- [https://access.redhat.com/errata/RHSA-2026:22649](https://access.redhat.com/errata/RHSA-2026:22649)
- [https://access.redhat.com/security/cve/CVE-2026-7263](https://access.redhat.com/security/cve/CVE-2026-7263)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2468572](https://bugzilla.redhat.com/show_bug.cgi?id=2468572)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json)

## Related threats

- [PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into)
- [PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070)
- [PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source)
- [PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp)
- [PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions)