PHP SOAP XML parser unbounded recursion denial of service via cleanup_xml_node

CVE-2026-91765 is an unbounded-recursion flaw in PHP's built-in SOAP extension. Three functions — cleanup_xml_node() (XML tree cleanup), master_to_zval_int() (value decoder following href chains), and get_node_with_attribute_recursive_ex() (WSDL node search) — all recurse once per XML nesting level with no depth guard. An unauthenticated attacker can POST a SOAP envelope containing tens of thousands of nested elements to any reachable SoapServer endpoint. The C-level recursion eats stack frames until the process hits the OS stack limit and segfaults. Under PHP-FPM the crashed worker is replaced, but a sustained stream of such requests drains the pool and takes the endpoint offline. Affected versions are PHP 8.2 < 8.2.34, 8.3 < 8.3.35, 8.4 < 8.4.26, and 8.5 < 8.5.11. The fix (shipped in those releases) introduces a SOAP_MAX_XML_DEPTH constant capped at 2048, converts the recursive helpers to iterative loops, and adds depth tracking in SOAP globals to break href cycles.

The vendor rates this HIGH 7.5, and the CVSS math is technically correct for the vector (network / no auth / no complexity / availability-only). However, the vendor score overstates the real-world urgency for most enterprises. The impact ceiling is a process crash — there is zero path to code execution, data exfiltration, or lateral movement. The attack surface is limited to the subset of PHP installations that (a) load the SOAP extension *and* (b) expose a SoapServer endpoint reachable by untrusted clients. Many PHP deployments use SOAP only as a *client* (SoapClient), which is not affected. PHP-FPM worker pools recover automatically, so achieving a sustained outage requires sustained attack traffic — something a basic rate limiter or WAF XML-depth rule defeats. EPSS is 0.55% (≈43rd percentile), there is no CISA KEV listing, no confirmed in-the-wild exploitation, and no published proof-of-concept code. noisgate downgrades this to MEDIUM 6.5.

Sources.

1. PHP Security Advisory (GHSA-rgrp-mwpx-f6rm)
2. Red Hat CVE Page
3. Debian Security Tracker
4. Amazon Linux 2 Advisory (ALAS2PHP8.2-2026-014)
5. TheHackerWire — PoC & Exploit Status
6. Mallory.ai Vulnerability Detail
7. OpenCVE Entry
8. VulDB Entry

Run this script on each target PHP host (web server or container) as any user with permission to execute php. No root required. Invoke: bash check_cve_2026_91765.sh — it checks the PHP version, whether ext/soap is loaded, and whether the fix constant SOAP_MAX_XML_DEPTH exists.

#!/usr/bin/env bash
# check_cve_2026_91765.sh — Detect CVE-2026-91765 (PHP SOAP unbounded recursion)
# Run on the target PHP host. No root needed.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PHP_BIN="${1:-php}"

# Check PHP binary exists
if ! command -v "$PHP_BIN" &>/dev/null; then
  echo "UNKNOWN — '$PHP_BIN' not found in PATH"
  exit 2
fi

# Check if SOAP extension is loaded
SOAP_LOADED=$( "$PHP_BIN" -m 2>/dev/null | grep -ci '^soap$' || true )
if [ "$SOAP_LOADED" -eq 0 ]; then
  echo "PATCHED — ext/soap is not loaded; CVE-2026-91765 is not reachable on this host"
  exit 0
fi

# Get PHP version
PHP_VERSION=$( "$PHP_BIN" -r 'echo PHP_VERSION;' 2>/dev/null )
if [ -z "$PHP_VERSION" ]; then
  echo "UNKNOWN — could not determine PHP version"
  exit 2
fi

echo "Detected PHP $PHP_VERSION with ext/soap loaded"

# Check for the fix constant SOAP_MAX_XML_DEPTH (introduced in the patch)
HAS_FIX=$( "$PHP_BIN" -r 'echo defined("SOAP_MAX_XML_DEPTH") ? "yes" : "no";' 2>/dev/null )
if [ "$HAS_FIX" = "yes" ]; then
  echo "PATCHED — SOAP_MAX_XML_DEPTH constant present (fix applied)"
  exit 0
fi

# Fallback: version comparison for known-fixed versions
# Fixed: 8.2.34, 8.3.35, 8.4.26, 8.5.11
version_gte() {
  # Returns 0 if $1 >= $2
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

MAJOR_MINOR=$( echo "$PHP_VERSION" | grep -oP '^\d+\.\d+' )
case "$MAJOR_MINOR" in
  8.2) FIXED="8.2.34" ;;
  8.3) FIXED="8.3.35" ;;
  8.4) FIXED="8.4.26" ;;
  8.5) FIXED="8.5.11" ;;
  *)
    # PHP 8.1 and below are EOL and likely vulnerable but won't get patches
    if version_gte "$PHP_VERSION" "9.0.0"; then
      echo "UNKNOWN — PHP $PHP_VERSION is newer than known affected range"
      exit 2
    fi
    echo "VULNERABLE — PHP $PHP_VERSION (EOL branch) with ext/soap loaded; no patch available"
    exit 1
    ;;
esac

if version_gte "$PHP_VERSION" "$FIXED"; then
  echo "PATCHED — PHP $PHP_VERSION >= $FIXED"
  exit 0
else
  echo "VULNERABLE — PHP $PHP_VERSION < $FIXED with ext/soap loaded"
  exit 1
fi