Uncontrolled Recursion Vulnerability in XenForo BBCode Parser

CVE-2026-73321

What is CVE-2026-73321?

XenForo versions prior to 2.3.13 are susceptible to an uncontrolled recursion vulnerability within the BBCode parser. This flaw enables authenticated attackers to craft a malicious post containing deeply nested BBCode tags. When submitted, this post can lead to a persistent denial of service by exceeding the stack limit of PHP, culminating in fatal errors that result in the termination of PHP-FPM workers. As a consequence, all visitors accessing the affected thread may face issues due to the repeated disruption of service.

References