GHSA-4jhr-8w89-j733

Опубликовано: 07 мая 2026

Источник: github

Github: Не прошло ревью

CVSS4: 8.2

Описание

DoS attack via DOMNode::C14N()

Researcher: Nikita Sveshnikov (Positive Technologies)

In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.

$doc = Dom\HTMLDocument::createFromString('<svg foo="foo" xmlns="" bar="bar">'); $doc->C14N(); // Segfault on cleanup // Or $doc = Dom\HTMLDocument::createFromString('<svg foo="foo" xmlns="" bar="bar">'); $doc->C14N(); $svg = $doc->documentElement->childNodes[1]->childNodes[0]; foreach ($svg->attributes as $prop) {} // This will loop forever

The attribute is removed incorrectly here:

https://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2134-L2141

Notice the attr->prev = attr->next; instead of attr->prev->next = attr->next;. The attribute is later (correctly) restored here:

https://github.com/php/php-src/blob/f0f28b763c8696511c3b80fb8b25ae8765b2d94b/ext/dom/node.c#L2182-L2189

After both procedures, the following graph:

flowchart TD A -- "Next" --> xmlns xmlns -- "Prev" --> A xmlns -- "Next" --> B B -- "Prev" --> xmlns

Would result in this graph:

flowchart TD A -- "Next" --> xmlns xmlns -- "Prev" --> B xmlns -- "Next" --> B B -- "Prev" --> xmlns B -- "Next" --> xmlns

Continuously following next will result in an infinite loop.

Пакеты

Наименование

php

Затронутые версииВерсия исправления

>=8.4.0, <8.4.21

8.4.21

Наименование

php

Затронутые версииВерсия исправления

>=8.5.0, <8.5.6

8.5.6

EPSS

Процентиль: 28%

0.00353

Низкий

8.2 High

CVSS4

CVE ID

CVE-2026-7263

Дефекты

CWE-404

Связанные уязвимости

CVE-2026-7263

CVSS3: 7.5

ubuntu

3 месяца назад

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.