CVE-2026-91765

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

• CWE-674

• https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91749Use after free in Workers in Google Chrome prior to 153.0.80…9.6
• CVE-2026-9175The Devs Accounting – Simple Accounting and Invoicing Soluti…5.3
• CVE-2026-91750WeKnora before 0.7.0 fails to re-validate HTTP redirect targ…6.5
• CVE-2026-91751Flextype CMS through 1.0.0-alpha.3 fails to properly validat…8.3
• CVE-2026-91752GNU libextractor before 1.15 contains a stack-based buffer o…7.5
• CVE-2026-9176IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.1
• CVE-2026-91766When the http:// stream wrapper follows a redirect it forwar…5.9
• CVE-2026-91767php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c …6.5
• CVE-2026-91769PHP's OpenSSL stream peer verification checks the certificat…4.3
• CVE-2026-9177A Server-Side Template Injection (SSTI) vulnerability was id…9.4
• CVE-2026-91770IceHRM before 36.0.0 fails to validate employee ownership on…6.5
• CVE-2026-91771Weights & Biases wandb before 0.29.0 fails to validate the f…8.8