SOAP XML Parser Vulnerability in PHP Affects Unauthenticated SOAP Requests

CVE-2026-91765

What is CVE-2026-91765?

A vulnerability has been identified in the SOAP XML parser of PHP which allows unauthenticated attackers to send specially crafted SOAP requests. These requests can contain a large number of nested XML elements, leading to unbounded recursion. This results in a stack exhaustion scenario that crashes the process handling the SOAP request. Additionally, similar unbounded recursion exists in the SOAP value decoder and WSDL node search helper, amplifying the potential for denial of service attacks.

References