CVE-2026-91765 in PHP
Summary
by MITRE • 09/25/2026
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability described involves an unrestricted recursive function within the SOAP XML parser component known as cleanup_xml_node(). This specific implementation flaw allows for a denial of service attack by exploiting the lack of depth limits during the parsing process. When processing incoming SOAP requests, the application recursively traverses nested XML elements to clean up memory or finalize node structures. Because there is no mechanism to track recursion depth or enforce a maximum nesting level, an attacker can craft a malicious SOAP envelope containing tens of thousands of deeply nested elements. This forces the server's call stack to expand exponentially until it exceeds its allocated memory limit, resulting in a stack overflow that crashes the SoapServer process and renders the service unavailable to legitimate users.
This issue is not isolated to a single function but represents a systemic architectural weakness within the SOAP handling logic. The same unbounded recursion pattern exists in the SOAP value decoder and the WSDL node search helper functions. These components also fail to implement safeguards against excessively deep XML structures, meaning that an attacker can trigger crashes through multiple entry points depending on how the request is processed or which specific endpoint is targeted. This broadens the attack surface significantly, as any interaction with these parsers can potentially lead to resource exhaustion and service disruption without requiring authentication credentials.
From a classification perspective, this vulnerability aligns closely with CWE-787: Out-of-bounds Write in contexts where stack corruption occurs due to excessive recursion, though it is more accurately categorized under CWE-400: Uncontrolled Resource Consumption or specifically as a Denial of Service via unbounded resource allocation. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1499: Endpoint Denial of Service, where an adversary uses techniques that exhaust computational resources such as CPU cycles or memory on targeted systems. The lack of input validation regarding XML depth is a common oversight in legacy SOAP implementations that prioritize parsing speed over structural safety checks.
To mitigate this vulnerability, developers must implement strict limits on the maximum allowed nesting depth for all XML parsers used within the application stack. This involves modifying cleanup_xml_node(), the value decoder, and the WSDL search helper to include counter variables that track recursion levels and terminate processing if a predefined threshold is exceeded. Additionally, integrating an external XML parser library with built-in protection against billion laughs attacks or deep nesting can provide a more robust defense than custom recursive implementations. Input validation should be enforced at the network perimeter using web application firewalls configured to detect and block SOAP requests with abnormally high levels of element nesting before they reach the vulnerable application logic.