CVE-2026-91765

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted request to an affected Simple Object Access Protocol (SOAP) server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing such requests exhausts system stack memory and crashes the application process.

An important-impact denial-of-service flaw exists in PHP's SOAP extension. When a SoapServer endpoint processes a specially crafted, deeply nested SOAP XML request, unbounded recursion in XML cleanup (and related decode/WSDL helpers) can exhaust the process stack and crash the PHP worker. Exploitation requires a reachable SoapServer that loads ext/soap; typical PHP applications that do not enable the SOAP extension or expose SoapServer are not affected by this attack path. Under PHP-FPM, repeated requests can exhaust the worker pool and take the application offline. Red Hat enterprise hardenings such as ASLR, NX, FORTIFY_SOURCE, and SELinux do not mitigate this stack-exhaustion DoS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If SoapServer is unused, disable or remove the SOAP extension (php-soap / extension=soap) so the vulnerable parser is not loaded. Restrict any exposed SoapServer endpoints to trusted clients using a host firewall or network segmentation. Process and cgroup resource limits may contain host impact but do not prevent PHP-FPM worker crashes or pool exhaustion from crafted nested SOAP requests.