CVE-2026-73321 in XenForo
Summary
by MITRE • 09/08/2026
XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in XenForo versions prior to 2.3.13 represents a critical uncontrolled recursion flaw within the platform's BBCode parsing engine. This issue stems from insufficient validation of input depth when processing nested formatting tags, allowing an authenticated user to construct payloads with excessive levels of nesting. In web application architectures, parsers often utilize recursive functions to traverse and interpret hierarchical data structures such as HTML or BBCode trees. When these functions lack proper bounds checking or stack size limits, they can consume system resources exponentially relative to the input depth. In this specific case, the parser does not enforce a maximum recursion limit, enabling an attacker to craft a single post containing deeply nested tags that trigger infinite or near-infinite recursive calls within the PHP execution environment.
From a technical perspective, this flaw exploits the way PHP manages its call stack during script execution. Each function call consumes memory on the stack, and exceeding the configured memory_limit or max_execution_time can lead to fatal errors. By submitting a post with sufficient nesting depth, an authenticated attacker forces the server-side parser into a state where it repeatedly attempts to process nested elements until the PHP-FPM worker processes crash due to stack overflow or resource exhaustion. This is not merely a client-side issue but a severe server-side vulnerability that impacts the stability of the entire web application infrastructure hosting XenForo instances.
The operational impact of this vulnerability is significant, primarily manifesting as a persistent denial of service condition for all users accessing the affected forum threads. Because PHP-FPM workers are responsible for handling HTTP requests and rendering dynamic content, their termination means that subsequent visitors attempting to view or interact with the compromised thread will encounter fatal errors rather than the expected page content. This effectively renders the specific discussion thread inaccessible until a server administrator manually clears the problematic post or restarts the affected worker processes. The persistence of this denial of service is notable because it does not require continuous exploitation; a single malicious submission can disrupt access for an extended period, impacting community engagement and potentially causing data loss if users are unable to save their own contributions during the outage window.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-675, which describes operations that do not respect untrusted input limits, specifically leading to resource exhaustion through recursion depth attacks. It also maps closely to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an adversary disrupts the availability of a target by exhausting its resources. Although the attack requires authentication, which raises the barrier for entry, it remains particularly dangerous in environments where user accounts can be easily created or compromised via phishing or credential stuffing attacks. The ability to cause denial of service through a single post submission highlights a failure in input sanitization and resource management within the application's core parsing logic.
Mitigation strategies must focus on immediate patching and defensive configuration adjustments. The primary remediation is upgrading XenForo to version 2.3.13 or later, where developers have implemented proper recursion limits and stack depth checks within the BBCode parser. For organizations unable to upgrade immediately due to compatibility constraints, implementing a Web Application Firewall (WAF) rule that detects and blocks excessively long strings of nested tags can provide temporary protection. Additionally, administrators should review PHP-FPM configuration settings such as max_children and request_terminate_timeout to ensure that worker crashes do not cascade into broader service outages across the entire server instance. Regular auditing of user-generated content for abnormal structural patterns can also help in identifying potential exploitation attempts before they trigger system-wide failures.