HighFix available
php8.2, php8.4 — security advisory
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
- Products
- php8.2, php8.4
- Affected versions
- 8.2.10-1, 8.2.10-2, 8.2.12-1, 8.2.16-1, 8.2.16-2, 8.2.17-1, 8.2.18-1, 8.2.18-1~deb12u1, 8.2.20-1~deb12u1, 8.2.20-2, 8.2.20-3, 8.2.21-1, 8.2.23-1, 8.2.24-1, 8.2.24-1~deb12u1, 8.2.26-1~deb12u1, 8.2.26-4, 8.2.27-1, 8.2.28-1~deb12u1, 8.2.29-1~deb12u1, 8.2.30-1~deb12u1, 8.2.31-1~deb12u1, 8.2.32-1~deb12u1, 8.2.33-1~deb12u1, 8.2.5-2, 8.2.7-1, 8.2.7-1.1, 8.2.7-1.2, 8.2.7-1~deb12u1, 8.4.11-1, 8.4.16-1, 8.4.16-1~deb13u1, 8.4.20-1, 8.4.21-1, 8.4.21-1~deb13u1, 8.4.22-1, 8.4.23-1, 8.4.23-1~deb13u1, 8.4.24-1, 8.4.24-1~deb13u1, 8.4.26-1~deb13u1
- Fixed versions
- 8.2.34-1~deb12u1, 8.4.26-1, 8.4.26-1~deb13u1
- CVEs
- CVE-2026-91765
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:05 UTC · Revision 1
Source evidence
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
osv:DEBIAN-CVE-2026-91765
php8.2
Fixed versions: 8.2.34-1~deb12u1
php8.4
Fixed versions: 8.4.26-1~deb13u1
php8.4
Fixed versions: 8.4.26-1
Complete source record
{
"id": "41d83bd75b6a1ef58538f66d33e734691879f19004ecbe4acebaf12da66cd9ad",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-91765",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-91765",
"summary": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.",
"evidence": "osv:DEBIAN-CVE-2026-91765",
"products": [
{
"name": {
"value": "php8.2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.2.34-1~deb12u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "8.2.10-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.10-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.12-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.16-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.16-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.17-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.18-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.18-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.20-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.20-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.20-3",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.21-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.23-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.24-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.24-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.26-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.26-4",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.27-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.28-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.29-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.30-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.31-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.32-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.33-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.7-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.7-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.7-1.2",
"evidence": "/affected/0/versions"
},
{
"value": "8.2.7-1~deb12u1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "php8.4",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.4.26-1~deb13u1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "8.4.11-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.16-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.16-1~deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.20-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.21-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.21-1~deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.22-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.23-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.23-1~deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.24-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.4.24-1~deb13u1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "php8.4",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.4.26-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "8.4.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.16-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.16-1~deb13u1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.20-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.21-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.21-1~deb13u1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.22-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.23-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.23-1~deb13u1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.24-1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.24-1~deb13u1",
"evidence": "/affected/2/versions"
},
{
"value": "8.4.26-1~deb13u1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-91765",
"aliases": [
"DEBIAN-CVE-2026-91765"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.34-1~deb12u1"
}
]
}
],
"package": {
"name": "php8.2",
"purl": "pkg:deb/debian/php8.2?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"8.2.10-1",
"8.2.10-2",
"8.2.12-1",
"8.2.16-1",
"8.2.16-2",
"8.2.17-1",
"8.2.18-1",
"8.2.18-1~deb12u1",
"8.2.20-1~deb12u1",
"8.2.20-2",
"8.2.20-3",
"8.2.21-1",
"8.2.23-1",
"8.2.24-1",
"8.2.24-1~deb12u1",
"8.2.26-1~deb12u1",
"8.2.26-4",
"8.2.27-1",
"8.2.28-1~deb12u1",
"8.2.29-1~deb12u1",
"8.2.30-1~deb12u1",
"8.2.31-1~deb12u1",
"8.2.32-1~deb12u1",
"8.2.33-1~deb12u1",
"8.2.5-2",
"8.2.7-1",
"8.2.7-1.1",
"8.2.7-1.2",
"8.2.7-1~deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91765.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.4.26-1~deb13u1"
}
]
}
],
"package": {
"name": "php8.4",
"purl": "pkg:deb/debian/php8.4?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"8.4.11-1",
"8.4.16-1",
"8.4.16-1~deb13u1",
"8.4.20-1",
"8.4.21-1",
"8.4.21-1~deb13u1",
"8.4.22-1",
"8.4.23-1",
"8.4.23-1~deb13u1",
"8.4.24-1",
"8.4.24-1~deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91765.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.4.26-1"
}
]
}
],
"package": {
"name": "php8.4",
"purl": "pkg:deb/debian/php8.4?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"8.4.11-1",
"8.4.16-1",
"8.4.16-1~deb13u1",
"8.4.20-1",
"8.4.21-1",
"8.4.21-1~deb13u1",
"8.4.22-1",
"8.4.23-1",
"8.4.23-1~deb13u1",
"8.4.24-1",
"8.4.24-1~deb13u1",
"8.4.26-1~deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91765.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-24T09:47:29.284127124Z",
"provider": "osv",
"upstream": [
"CVE-2026-91765"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-91765"
]
},
"related_cves": [
{
"value": "CVE-2026-91765",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 428978,
"published_at": "2026-09-25T21:17:24.55+00:00"
}