Bug 2541646 (CVE-2026-91765)

Summary:	CVE-2026-91765 php: php: Denial of Service via unbounded recursion in SOAP parser
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	Farooq.Syed, rhel-process-autobot, sdawley, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted request to an affected Simple Object Access Protocol (SOAP) server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing such requests exhausts system stack memory and crashes the application process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2544160
Bug Blocks:

Description OSIDB Bzimport 2026-09-25 20:57:36 UTC

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Comment 2 Jon Orris 2026-10-21 15:45:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87080 https://access.redhat.com/errata/RHSA-2026:87080

Comment 3 Farooq Syed 2026-10-21 17:23:16 UTC

Hi,

When are you releasing updates for RHEL Red Hat Enterprise Linux 9?...not fetching any updates from repos

# dnf check-update php\* --refresh
Updating Subscription Management repositories.
PBISE- local packages for x86_64                                                                                               12 kB/s | 3.0 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)                                                                         9.4 kB/s | 4.1 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)                                                                       17 kB/s | 4.5 kB     00:00


Thanks

Comment 4 Jon Orris 2026-10-21 19:58:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87151 https://access.redhat.com/errata/RHSA-2026:87151

Comment 5 Jon Orris 2026-10-21 20:03:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:87071 https://access.redhat.com/errata/RHSA-2026:87071

Comment 6 Jon Orris 2026-10-21 20:05:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:87070 https://access.redhat.com/errata/RHSA-2026:87070

Comment 7 Jon Orris 2026-10-21 20:22:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:87073 https://access.redhat.com/errata/RHSA-2026:87073

Comment 8 Jon Orris 2026-10-21 20:27:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87079 https://access.redhat.com/errata/RHSA-2026:87079

Comment 9 Jon Orris 2026-10-21 20:27:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:87072 https://access.redhat.com/errata/RHSA-2026:87072