CVE-2026-91765

{
  "etk_id": "ETK-2026-2328",
  "cve_id": "CVE-2026-91765",
  "display_id": "CVE-2026-91765",
  "ghsa_id": "GHSA-rgrp-mwpx-f6rm",
  "euvd_id": "EUVD-2026-87355",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded XML recursion in PHP ext-soap",
  "summary": "PHP applications using ext-soap and exposing a SoapServer endpoint are affected by unbounded recursion when processing deeply nested SOAP XML. An unauthenticated remote attacker can crash the handling process and, through repeated requests, disrupt the endpoint; exposure requires a reachable SoapServer endpoint.",
  "mitigation": "Upgrade PHP ext-soap to 8.2.34, 8.3.35, 8.4.26, or 8.5.11, as appropriate for your PHP branch. Until upgraded, restrict access to SoapServer endpoints and reject excessively nested XML requests at an upstream gateway where possible.",
  "vendor": "php",
  "product": "php:ext-soap",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<8.2.34"
      ],
      "ecosystem": "php",
      "fixed_versions": [
        "8.2.34"
      ],
      "package_name": "ext-soap",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<8.3.35"
      ],
      "ecosystem": "php",
      "fixed_versions": [
        "8.3.35"
      ],
      "package_name": "ext-soap",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<8.4.26"
      ],
      "ecosystem": "php",
      "fixed_versions": [
        "8.4.26"
      ],
      "package_name": "ext-soap",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<8.5.11"
      ],
      "ecosystem": "php",
      "fixed_versions": [
        "8.5.11"
      ],
      "package_name": "ext-soap",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.204694583333334,
  "t0_at": "2026-09-25T20:33:03.634000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-24T10:06:35+00:00",
      "days": -1.4350536342592592,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T20:33:03.634000+00:00",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"
    },
    "trigger_signal": {
      "at": "2026-09-25T20:33:03.634000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T20:33:03.634000+00:00",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"
    }
  }
}