Executive brief
XenForo is a community forum platform used to host user discussions. A flaw in its message parsing feature allows attackers to crash the web server by posting a message with deeply nested formatting tags, temporarily disrupting service for all forum visitors until the server restarts.
Technical details
An uncontrolled recursion vulnerability exists in XenForo's BBCode parser where the maximum-depth limit is enforced after recursive parsing has already consumed stack memory, not before. An unauthenticated attacker can submit a specially crafted BBCode payload with 5,000 nested [quote] tags (approximately 75 KB) to the publicly accessible editor/to-html endpoint, causing the PHP worker process to exceed the stack limit and terminate with a stack overflow exception. This denial of service is repeatable per request, and concurrent malicious requests can temporarily exhaust the available worker pool. The vulnerability was fixed in XenForo 2.3.13 by moving the depth-limit check before recursive parsing.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed