CVE-2026-7263
Fixed in a distro release EPSS <1%CVSS 6.3
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Products: PHP Group PHP, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | php8.4 | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-bcmath | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-cli | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-common | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-dba | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-dbg | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-devel | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-embedded | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-enchant | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-ffi | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-fpm | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-gd | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-gmp | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-intl | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-ldap | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-mbstring | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-mysqlnd | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-odbc | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-opcache | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-pdo | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-pgsql | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-process | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-snmp | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-soap | 8.4.21-1.el10_2 |
| AlmaLinux:10 | php8.4-xml | 8.4.21-1.el10_2 |
| Debian:13 | php8.4 | 8.4.21-1~deb13u1 |
| Debian:14 | php8.4 | 8.4.21-1 |
| Red Hat:enterprise_linux:10.2 | php8.4 | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-bcmath | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-bcmath-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-cli | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-cli-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-common | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-common-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-dba | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-dba-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-dbg | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-dbg-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-debugsource | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-devel | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-embedded | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-embedded-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-enchant | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-enchant-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-ffi | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-ffi-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-fpm | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-fpm-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-gd | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-gd-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-gmp | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-gmp-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-intl | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-intl-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-ldap | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-ldap-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-mbstring | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-mbstring-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-mysqlnd | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-mysqlnd-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-odbc | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-odbc-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-opcache | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-opcache-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-pdo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-pdo-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-pgsql | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-pgsql-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-process | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-process-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-snmp | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-snmp-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-soap | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-soap-debuginfo | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-xml | 0:8.4.21-1.el10_2 |
| Red Hat:enterprise_linux:10.2 | php8.4-xml-debuginfo | 0:8.4.21-1.el10_2 |
| Rocky Linux:10 | php8.4 | 0:8.4.21-1.el10_2 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.24 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.9 |
| Ubuntu:25.10 | php8.4 | 8.4.11-1ubuntu1.2 |
| Ubuntu:26.04:LTS | php8.5 | 8.5.4-0ubuntu1.1 |
| openSUSE:Tumbleweed | php8 | 8.5.6-1.1 |