# CVE-2026-91765: PHP SOAP XML parser unbounded recursion denial of service

Source: https://junglewise.ai/threats/cve-2026-91765-cleanup-xml-node-in-the-soap-xml-parser-recurses-once-per-xml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91765 · Severity: high · CVSS 7.5 · Published 2026-09-25

PHP's SOAP server implementation contains an unbounded recursion vulnerability in its XML parser that crashes the server process when parsing deeply nested XML documents. An attacker can send a specially crafted SOAP request with tens of thousands of nested elements to any SoapServer endpoint, exhausting the call stack and causing a denial of service. No authentication or special configuration is required, making any publicly exposed SOAP endpoint vulnerable to being taken offline with a single HTTP request.

Technologies: [Php](https://junglewise.ai/threats/technologies/php-php). Vendors: [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2026-91765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91765 being exploited in the wild.

**How severe is CVE-2026-91765?** High severity, with a CVSS score of 7.5, published 25 September 2026.

**Which products and versions are affected?** Php <8.2.34, <8.3.35, <8.4.26, <8.5.11.

**Is there a fix for CVE-2026-91765?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91765 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-91765?** Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The cleanup_xml_node() function in ext/soap/php_xml.c recursively traverses the parsed XML document tree without enforcing any depth limit, causing stack exhaustion when processing deeply nested structures. The vulnerability affects SoapServer::handle() processing of php://input streams, and similar unbounded recursion issues exist in master_to_zval_int() (value decoder) and get_node_with_attribute_recursive_ex() (WSDL search). The fix introduces SOAP_MAX_XML_DEPTH (2048) limit and converts vulnerable functions to iterative traversals.

## Affected products

- PHP PHP <8.2.34, <8.3.35, <8.4.26, <8.5.11

## Timeline

- 2026-09-25: disclosed: CVE-2026-91765 published

## References

- [https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm](https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm)

## Related threats

- [PHP stream filter heap information leak with NUL bytes in line-break-chars](https://junglewise.ai/threats/cve-2026-92842-the-convert-base64-encode-convert-quoted-printable-encode-and)
- [PHP OpenSSL stream peer verification certificate validation bypass](https://junglewise.ai/threats/cve-2026-91769-php-s-openssl-stream-peer-verification-checks-the-certificate-s)
- [PHP OpenSSL heap-buffer overflow in wildcard certificate name matching](https://junglewise.ai/threats/cve-2026-91767-php-openssl-matches-wildcard-name-in-ext-openssl-xp-ssl-c)
- [PHP HTTP stream wrapper credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-91766-when-the-http-stream-wrapper-follows-a-redirect-it-forwards-the)
- [PHP Phar TAR integer overflow in size parsing](https://junglewise.ai/threats/cve-2026-6103-phar-tar-number-parses-the-octal-size-field-of-a-tar-header-into-a)