Vulnerability-Lookup

CVE-2026-7263 (GCVE-0-2026-7263)

Vulnerability from cvelistv5 – Published: 2026-05-10 04:43 – Updated: 2026-07-15 00:40

Title

DoS attack via DOMNode::C14N()

Summary

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-404 - Improper Resource Shutdown or Release
CWE-835 - Loop with unreachable exit condition ('infinite loop')
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

php

References

5 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-7263	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2468572	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:22649	vendor-advisoryx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.4.* , < 8.4.21 (semver) Affected: 8.5.* , < 8.5.6 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:8.4.21-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Date Public

2026-05-07 00:00

Credits

Nikita Sveshnikov (Positive Technologies) Ilija Tovilo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T13:04:22.553796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T13:04:26.399Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "php8.4",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:8.4.21-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php:7.4/php",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php:8.2/php",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php:8.2/php",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php:8.3/php",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "php",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-10T04:43:04.483Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in PHP. The `DOMNode::C14N()` method may incorrectly process XML data due to the improper removal of an `xmlns` attribute from the underlying libxml2 data structure, corrupting the linked list representing the XML document and causing an infinite loop. This issue can lead to excessive resource consumption, eventually resulting in a denial of service in the processing application."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:40:16.236Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-7263"
          },
          {
            "name": "RHBZ#2468572",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468572"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22649"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:22649: Red Hat Enterprise Linux AppStream (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-10T06:00:59.933Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-10T04:43:04.483Z",
            "value": "Made public."
          }
        ],
        "title": "php: denial of service via DOMNode::C14N()",
        "workarounds": [
          {
            "lang": "en",
            "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "dom",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.4.21",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.6",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nikita Sveshnikov (Positive Technologies)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ilija Tovilo"
        }
      ],
      "datePublic": "2026-05-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, \u003ccode\u003eDOMNode::C14N()\u003c/code\u003e\u0026nbsp;method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N()\u00a0method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404 Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835 Loop with unreachable exit condition (\u0027infinite loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-10T04:46:28.150Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733"
        }
      ],
      "source": {
        "advisory": "GHSA-4jhr-8w89-j733",
        "discovery": "EXTERNAL"
      },
      "title": "DoS attack via DOMNode::C14N()",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-7263",
    "datePublished": "2026-05-10T04:43:04.483Z",
    "dateReserved": "2026-04-28T05:12:25.217Z",
    "dateUpdated": "2026-07-15T00:40:16.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-7263",
      "date": "2026-07-22",
      "epss": "0.00353",
      "percentile": "0.27804"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-7263\",\"sourceIdentifier\":\"security@php.net\",\"published\":\"2026-05-10T06:16:08.343\",\"lastModified\":\"2026-07-15T01:16:58.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N()\u00a0method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.\"}],\"affected\":[{\"source\":\"security@php.net\",\"affectedData\":[{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"defaultStatus\":\"unaffected\",\"packageName\":\"dom\",\"versions\":[{\"version\":\"8.4.*\",\"lessThan\":\"8.4.21\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.5.*\",\"lessThan\":\"8.5.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php8.4\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:8.4.21-1.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php:7.4/php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php:8.2/php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php:8.2/php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php:8.3/php\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"php\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-11T13:04:22.553796Z\",\"id\":\"CVE-2026-7263\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-404\"},{\"lang\":\"en\",\"value\":\"CWE-835\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0\",\"versionEndExcluding\":\"8.4.21\",\"matchCriteriaId\":\"BA663C03-392C-41CC-BD11-4A1245203C42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"8.5.6\",\"matchCriteriaId\":\"6101DA12-5AA1-4882-A52A-61FB74254F9A\"}]}]}],\"references\":[{\"url\":\"https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733\",\"source\":\"security@php.net\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22649\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-7263\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2468572\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-30T03:41:19+00:00",
      "cve": "CVE-2026-7263",
      "id": "CVE-2026-7263",
      "initial_release_date": "2026-05-10T04:43:04.483000+00:00",
      "product_status:fixed": "201",
      "product_status:known_not_affected": "253",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "php: denial of service via DOMNode::C14N()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-15T05:38:11Z",
      "cve": "CVE-2026-7263",
      "id": "CVE-2026-7263",
      "initial_release_date": "2026-05-11T14:17:42Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "1561",
      "product_status:recommended": "232",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-7263",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-7263.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"php: denial of service via DOMNode::C14N()\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:8.4.21-1.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"php8.4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"php:7.4/php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"php:8.2/php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"php:8.2/php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"php:8.3/php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"php\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-10T06:00:59.933Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-10T04:43:04.483Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:22649: Red Hat Enterprise Linux AppStream (v. 10)\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-10T04:43:04.483Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-7263\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2468572\", \"name\": \"RHBZ#2468572\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22649\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in PHP. The `DOMNode::C14N()` method may incorrectly process XML data due to the improper removal of an `xmlns` attribute from the underlying libxml2 data structure, corrupting the linked list representing the XML document and causing an infinite loop. This issue can lead to excessive resource consumption, eventually resulting in a denial of service in the processing application.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-15T00:40:16.236Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-7263\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-11T13:04:22.553796Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-11T13:04:18.459Z\"}}], \"cna\": {\"title\": \"DoS attack via DOMNode::C14N()\", \"source\": {\"advisory\": \"GHSA-4jhr-8w89-j733\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Nikita Sveshnikov (Positive Technologies)\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Ilija Tovilo\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.3, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"PHP Group\", \"product\": \"PHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.4.*\", \"lessThan\": \"8.4.21\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.5.*\", \"lessThan\": \"8.5.6\", \"versionType\": \"semver\"}], \"packageName\": \"dom\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-05-07T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N()\\u00a0method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, \u003ccode\u003eDOMNode::C14N()\u003c/code\u003e\u0026nbsp;method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-404\", \"description\": \"CWE-404 Improper Resource Shutdown or Release\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835 Loop with unreachable exit condition (\u0027infinite loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"shortName\": \"php\", \"dateUpdated\": \"2026-05-10T04:46:28.150Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-7263\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-15T00:40:16.236Z\", \"dateReserved\": \"2026-04-28T05:12:25.217Z\", \"assignerOrgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"datePublished\": \"2026-05-10T04:43:04.483Z\", \"assignerShortName\": \"php\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ubuntu-cve-2026-7263

Vulnerability from osv_ubuntu

Published

2026-05-10 06:16

Modified

2026-06-30 16:18

Summary

Details

In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

Severity

6.3 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-7263	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-7263	REPORT
	https://github.com/php/php-src/security/advisorie…	REPORT
	https://ubuntu.com/security/notices/USN-8336-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libapache2-mod-php8.5",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "libphp8.5-embed",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-bcmath",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-bz2",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-cgi",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-cli",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-common",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-curl",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-dba",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-enchant",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-fpm",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-gd",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-gmp",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-interbase",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-intl",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-ldap",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-litespeed",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-mbstring",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-mysql",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-odbc",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-pgsql",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-phpdbg",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-readline",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-snmp",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-soap",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-sqlite3",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-sybase",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-tidy",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-xml",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-xsl",
            "binary_version": "8.5.4-0ubuntu1.1"
          },
          {
            "binary_name": "php8.5-zip",
            "binary_version": "8.5.4-0ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "php8.5",
        "purl": "pkg:deb/ubuntu/php8.5@8.5.4-0ubuntu1.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.4-0ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.2-0ubuntu1",
        "8.5.4-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N()\u00a0method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.",
  "id": "UBUNTU-CVE-2026-7263",
  "modified": "2026-06-30T16:18:39Z",
  "published": "2026-05-10T06:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-7263"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7263"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8336-1"
    }
  ],
  "related": [
    "USN-8336-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-7263"
  ]
}

WID-SEC-W-2026-1433

Vulnerability from csaf_certbund - Published: 2026-05-07 22:00 - Updated: 2026-06-07 22:00

Summary

PHP: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: PHP ist eine Programmiersprache, die zur Implementierung von Web-Applikationen genutzt wird.

Angriff: Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2025-14179

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-6104

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-6722

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-6735

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-7258

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-7259

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-7261

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-7262

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-7263

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

CVE-2026-7568

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat	`cpe:/o:redhat:enterprise_linux:-`	—
Open Source PHP <8.4.21 Open Source / PHP		<8.4.21
cPanel cPanel/WHM <126.0.67 cPanel / cPanel/WHM		<126.0.67
Open Source PHP <8.3.31 Open Source / PHP		<8.3.31
Open Source PHP <8.2.31 Open Source / PHP		<8.2.31
Zend ZendPHP <8.5.6 Zend / ZendPHP		<8.5.6
Open Source PHP <8.5.6 Open Source / PHP		<8.5.6
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Microsoft Azure Linux azl3 Microsoft / Azure Linux	`cpe:/o:microsoft:azure_linux:azl3`	azl3

References

38 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://php.net/ChangeLog-8.php#8.2.31	external
https://php.net/ChangeLog-8.php#8.5.6	external
https://php.net/ChangeLog-8.php#8.4.21	external
https://php.net/ChangeLog-8.php#8.3.31	external
https://lists.debian.org/debian-security-announce…	external
https://lists.debian.org/debian-security-announce…	external
https://msrc.microsoft.com/update-guide/	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://access.redhat.com/errata/RHSA-2026:14125	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-…	external
https://www.zend.com/release-notes/zendphp/may-20…	external
https://alas.aws.amazon.com/AL2/ALAS2-2026-3316.html	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://ubuntu.com/security/notices/USN-8336-1	external
https://access.redhat.com/errata/RHSA-2026:22143	external
https://errata.build.resf.org/RLSA-2026:22142	external
https://errata.build.resf.org/RLSA-2026:22143	external
https://access.redhat.com/errata/RHSA-2026:22142	external
https://access.redhat.com/errata/RHSA-2026:22305	external
https://errata.build.resf.org/RLSA-2026:22305	external
https://docs.cpanel.net/changelogs/126-change-log/	external
https://access.redhat.com/errata/RHSA-2026:22649	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://access.redhat.com/errata/RHSA-2026:23388	external
http://linux.oracle.com/errata/ELSA-2026-22305.html	external
https://errata.build.resf.org/RLSA-2026:22649	external
https://errata.build.resf.org/RLSA-2026:23388	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "PHP ist eine Programmiersprache, die zur Implementierung von Web-Applikationen genutzt wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuf\u00fchren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuf\u00fchren, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1433 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1433.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1433 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1433"
      },
      {
        "category": "external",
        "summary": "PHP Release Notes vom 2026-05-07",
        "url": "https://php.net/ChangeLog-8.php#8.2.31"
      },
      {
        "category": "external",
        "summary": "PHP Release Notes vom 2026-05-07",
        "url": "https://php.net/ChangeLog-8.php#8.5.6"
      },
      {
        "category": "external",
        "summary": "PHP Release Notes vom 2026-05-07",
        "url": "https://php.net/ChangeLog-8.php#8.4.21"
      },
      {
        "category": "external",
        "summary": "PHP Release Notes vom 2026-05-07",
        "url": "https://php.net/ChangeLog-8.php#8.3.31"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6256 vom 2026-05-08",
        "url": "https://lists.debian.org/debian-security-announce/2026/msg00167.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6255 vom 2026-05-08",
        "url": "https://lists.debian.org/debian-security-announce/2026/msg00166.html"
      },
      {
        "category": "external",
        "summary": "Microsoft Security Update Guide vom 2026-05-12",
        "url": "https://msrc.microsoft.com/update-guide/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:21612-1 vom 2026-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/026031.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4586 vom 2026-05-16",
        "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00031.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1958-1 vom 2026-05-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/026135.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1957-1 vom 2026-05-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/026136.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:20745-1 vom 2026-05-19",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AGRXNVTMRBCHCLXDSZW5XXRVEXKGMQD2/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:14125 vom 2026-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:14125"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2037-1 vom 2026-05-21",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/026205.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2PHP8.2-2026-011 vom 2026-05-26",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-011.html"
      },
      {
        "category": "external",
        "summary": "ZendPHP May 2026 Releases vom 2026-05-26",
        "url": "https://www.zend.com/release-notes/zendphp/may-2026-releases"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2026-3316 vom 2026-05-26",
        "url": "https://alas.aws.amazon.com/AL2/ALAS2-2026-3316.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2091-1 vom 2026-05-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/026366.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-8336-1 vom 2026-05-28",
        "url": "https://ubuntu.com/security/notices/USN-8336-1"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22143 vom 2026-06-01",
        "url": "https://access.redhat.com/errata/RHSA-2026:22143"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:22142 vom 2026-06-01",
        "url": "https://errata.build.resf.org/RLSA-2026:22142"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:22143 vom 2026-06-01",
        "url": "https://errata.build.resf.org/RLSA-2026:22143"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22142 vom 2026-06-01",
        "url": "https://access.redhat.com/errata/RHSA-2026:22142"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22305 vom 2026-06-01",
        "url": "https://access.redhat.com/errata/RHSA-2026:22305"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:22305 vom 2026-06-01",
        "url": "https://errata.build.resf.org/RLSA-2026:22305"
      },
      {
        "category": "external",
        "summary": "cPanel Change Log vom 2026-06-01",
        "url": "https://docs.cpanel.net/changelogs/126-change-log/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22649 vom 2026-06-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:22649"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-B08259FEC1 vom 2026-06-03",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b08259fec1"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-6C66671917 vom 2026-06-03",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6c66671917"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-7D8FE2FA97 vom 2026-06-03",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7d8fe2fa97"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-B1204DFF3A vom 2026-06-03",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b1204dff3a"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-A70B06FDF5 vom 2026-06-03",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a70b06fdf5"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:23388 vom 2026-06-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:23388"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-22305 vom 2026-06-04",
        "url": "http://linux.oracle.com/errata/ELSA-2026-22305.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:22649 vom 2026-06-05",
        "url": "https://errata.build.resf.org/RLSA-2026:22649"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:23388 vom 2026-06-06",
        "url": "https://errata.build.resf.org/RLSA-2026:23388"
      }
    ],
    "source_lang": "en-US",
    "title": "PHP: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-07T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-08T09:29:00.797+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1433",
      "initial_release_date": "2026-05-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-10T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian und European Union Vulnerability Database aufgenommen"
        },
        {
          "date": "2026-05-11T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-05-14T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-05-17T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2026-05-18T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-05-21T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-05-26T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2026-05-27T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2026-05-28T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2026-05-31T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-06-01T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-06-02T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-04T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        }
      ],
      "status": "final",
      "version": "15"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "azl3",
                "product": {
                  "name": "Microsoft Azure Linux azl3",
                  "product_id": "T049210",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:microsoft:azure_linux:azl3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.2.31",
                "product": {
                  "name": "Open Source PHP \u003c8.2.31",
                  "product_id": "T053710"
                }
              },
              {
                "category": "product_version",
                "name": "8.2.31",
                "product": {
                  "name": "Open Source PHP 8.2.31",
                  "product_id": "T053710-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:php:php:8.2.31"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.5.6",
                "product": {
                  "name": "Open Source PHP \u003c8.5.6",
                  "product_id": "T053711"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.6",
                "product": {
                  "name": "Open Source PHP 8.5.6",
                  "product_id": "T053711-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:php:php:8.5.6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.4.21",
                "product": {
                  "name": "Open Source PHP \u003c8.4.21",
                  "product_id": "T053712"
                }
              },
              {
                "category": "product_version",
                "name": "8.4.21",
                "product": {
                  "name": "Open Source PHP 8.4.21",
                  "product_id": "T053712-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:php:php:8.4.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.3.31",
                "product": {
                  "name": "Open Source PHP \u003c8.3.31",
                  "product_id": "T053713"
                }
              },
              {
                "category": "product_version",
                "name": "8.3.31",
                "product": {
                  "name": "Open Source PHP 8.3.31",
                  "product_id": "T053713-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:php:php:8.3.31"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PHP"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.5.6",
                "product": {
                  "name": "Zend ZendPHP \u003c8.5.6",
                  "product_id": "T054712"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.6",
                "product": {
                  "name": "Zend ZendPHP 8.5.6",
                  "product_id": "T054712-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zend:zendphp:8.5.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ZendPHP"
          }
        ],
        "category": "vendor",
        "name": "Zend"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c126.0.67",
                "product": {
                  "name": "cPanel cPanel/WHM \u003c126.0.67",
                  "product_id": "T054923"
                }
              },
              {
                "category": "product_version",
                "name": "126.0.67",
                "product": {
                  "name": "cPanel cPanel/WHM 126.0.67",
                  "product_id": "T054923-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cpanel:cpanel_whm:126.0.67"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "cPanel/WHM"
          }
        ],
        "category": "vendor",
        "name": "cPanel"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14179",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2025-14179"
    },
    {
      "cve": "CVE-2026-6104",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-6104"
    },
    {
      "cve": "CVE-2026-6722",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-6722"
    },
    {
      "cve": "CVE-2026-6735",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-6735"
    },
    {
      "cve": "CVE-2026-7258",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-7258"
    },
    {
      "cve": "CVE-2026-7259",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-7259"
    },
    {
      "cve": "CVE-2026-7261",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-7261"
    },
    {
      "cve": "CVE-2026-7262",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-7262"
    },
    {
      "cve": "CVE-2026-7263",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-7263"
    },
    {
      "cve": "CVE-2026-7568",
      "product_status": {
        "known_affected": [
          "67646",
          "T053712",
          "T054923",
          "T053713",
          "T053710",
          "T054712",
          "T053711",
          "T004914",
          "T032255",
          "74185",
          "2951",
          "T002207",
          "T000126",
          "T027843",
          "398363",
          "T049210"
        ]
      },
      "release_date": "2026-05-07T22:00:00.000+00:00",
      "title": "CVE-2026-7568"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-7263 (GCVE-0-2026-7263)

ubuntu-cve-2026-7263

Vulnerability from osv_ubuntu

WID-SEC-W-2026-1433

Tags

Sightings

Nomenclature