CVE-2026-91765

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

• CWE-674

• https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rmVendor Advisory, Exploit

Published

Sep 25, 2026

Last Modified

Oct 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9176IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.1
• CVE-2026-91760Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic …7
• CVE-2026-91761UNIX Symbolic Link (Symlink) Following Vulnerability in Hita…8.2
• CVE-2026-91762UNIX Symbolic Link (Symlink) Following Vulnerability in Hita…7.9
• CVE-2026-91763UNIX Symbolic Link (Symlink) Following Vulnerability in Hita…8.2
• CVE-2026-91764Improper Link Resolution Before File Access Vulnerability in…8.1
• CVE-2026-91766When the http:// stream wrapper follows a redirect it forwar…5.9
• CVE-2026-91767php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c …6.5
• CVE-2026-91768The IPv6 branch of the FastCGI client access check compares …6.5
• CVE-2026-91769PHP's OpenSSL stream peer verification checks the certificat…4.3
• CVE-2026-9177A Server-Side Template Injection (SSTI) vulnerability was id…9.4
• CVE-2026-91770IceHRM before 36.0.0 fails to validate employee ownership on…6.5