{"id":"CVE-2026-7263","aliases":["ALPINE-CVE-2026-7263","ALSA-2026:22649","BELL-CVE-2026-7263","BIT-libphp-2026-7263","BIT-php-2026-7263","BIT-php-min-2026-7263","DEBIAN-CVE-2026-7263","EUVD-2026-28981","RHSA-2026:22649","RLSA-2026:22649","SUSE-SU-2026:21612-1","UBUNTU-CVE-2026-7263","openSUSE-SU-2026:10747-1","openSUSE-SU-2026:20745-1"],"status":"published","title":"DoS attack via DOMNode::C14N()","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00353,"percentile":0.29219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-404","CWE-835"],"published":"2026-05-10T04:43:04Z","modified":"2026-11-06T12:00:03Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"php84","fixed_in":["8.4.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php84","fixed_in":["8.4.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php85","fixed_in":["8.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"php85","fixed_in":["8.5.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["8.4.21","8.5.6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["8.4.21","8.5.6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["8.4.21","8.5.6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php8.4","fixed_in":["8.4.21-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php8.4","fixed_in":["8.4.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","fixed_in":["8.5.4-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"php85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.21"},{"introduced":"8.5.0"},{"fixed":"8.5.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.21"},{"introduced":"8.5.0"},{"fixed":"8.5.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.21"},{"introduced":"8.5.0"},{"fixed":"8.5.6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1~deb13u1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1","8.4.21-1~deb13u1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-bcmath-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-cli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dbg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-embedded-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-enchant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-fpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-intl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mbstring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mysqlnd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-opcache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pdo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-process-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-soap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-xml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.4-0ubuntu1.1"}]}],"versions":["8.5.2-0ubuntu1","8.5.4-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-1.1"}]}],"bundled":11}],"products":[{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7263","tags":["vdb-entry","x_refsource_REDHAT","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468572","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7263.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22649","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-7263","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6104","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6735","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7258","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7262","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7568","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468561","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468562","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468565","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468566","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468572","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468573","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-22649.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-6722.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-7261.html","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-7263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7263","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7263","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468573","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22649.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6104","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6722","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6722","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6735","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7258","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7261","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7262","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7263","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7568","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22649","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621612-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264769","tags":["report"]},{"url":"https://bugzilla.suse.com/1264770","tags":["report"]},{"url":"https://bugzilla.suse.com/1264771","tags":["report"]},{"url":"https://bugzilla.suse.com/1264772","tags":["report"]},{"url":"https://bugzilla.suse.com/1264773","tags":["report"]},{"url":"https://bugzilla.suse.com/1264774","tags":["report"]},{"url":"https://bugzilla.suse.com/1264775","tags":["report"]},{"url":"https://bugzilla.suse.com/1264776","tags":["report"]},{"url":"https://bugzilla.suse.com/1264777","tags":["report"]},{"url":"https://bugzilla.suse.com/1264778","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7568","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-7263","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8336-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42371","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-7263","title":"DoS attack via DOMNode::C14N()","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-10T04:43:04.483Z","modified":"2026-07-15T00:40:16.236Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-404","CWE-835","CWE-835"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-28981","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-10T04:43:04Z","modified":"2026-07-15T00:40:16Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T18:19:56.918546Z"}],"nvd":[{"id":"CVE-2026-7263","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-10T06:16:08.343Z","modified":"2026-07-24T08:10:00.15Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-404","CWE-835"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"ALPINE-CVE-2026-7263","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-10T06:16:08.343Z","modified":"2026-11-03T06:33:05.793101146Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-7263","title":"CVE-2026-7263 does not affect BellSoft software","status":"withdrawn","published":"2026-05-21T06:10:55.474394Z","modified":"2026-05-26T07:15:15.17619267Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:25.777499Z"},{"id":"DEBIAN-CVE-2026-7263","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-10T06:16:08.343Z","modified":"2026-10-01T03:03:40.88230208Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"RHSA-2026:22649","title":"Red Hat Security Advisory: php8.4 security update","status":"published","published":"2026-06-03T10:20:16Z","modified":"2026-09-22T10:09:40Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:22649","title":"Important: php8.4 security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.\n\nSecurity Fix(es):\n\n* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)\n\n* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)\n\n* php: NULL pointer dereference in SOAP apache:Map decoder with missing \u003cvalue\u003e (CVE-2026-7262)\n\n* php: signed integer overflow in metaphone() (CVE-2026-7568)\n\n* php: denial of service via DOMNode::C14N() (CVE-2026-7263)\n\n* php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-05T12:04:50.053452Z","modified":"2026-06-05T12:30:05.848902694Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-7263","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-10T06:16:00Z","modified":"2026-06-30T18:18:14.489358152Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/AU:Y/RE:M/U:Amber","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"ALSA-2026:22649","title":"Important: php8.4 security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.  \n\nSecurity Fix(es):  \n\n  * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)\n  * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)\n  * php: NULL pointer dereference in SOAP apache:Map decoder with missing \u003cvalue\u003e (CVE-2026-7262)\n  * php: signed integer overflow in metaphone() (CVE-2026-7568)\n  * php: denial of service via DOMNode::C14N() (CVE-2026-7263)\n  * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-02T00:00:00Z","modified":"2026-11-06T12:00:03.723699294Z","updated_at":"2026-11-06T12:12:56.168821Z"},{"id":"BIT-libphp-2026-7263","title":"DoS attack via DOMNode::C14N()","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-12T08:50:32.155Z","modified":"2026-09-10T16:00:10.792676562Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-php-2026-7263","title":"DoS attack via DOMNode::C14N()","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-12T08:56:10.333Z","modified":"2026-09-10T16:01:45.679691785Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-php-min-2026-7263","title":"DoS attack via DOMNode::C14N()","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.","status":"published","published":"2026-05-12T08:56:20.593Z","modified":"2026-09-10T16:00:11.484038874Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"openSUSE-SU-2026:10747-1","title":"php8-8.5.6-1.1 on GA media","description":"These are all security issues fixed in the php8-8.5.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T08:45:39.938086Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20745-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL\n  injection (bsc#1264778).\n- CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in\n  `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777).\n- CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).\n- CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).\n- CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of\n  service (bsc#1264774).\n- CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial\n  of service (bsc#1264773).\n- CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION\n  is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).\n- CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured\n  can lead to a denial of service (bsc#1264771).\n- CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite loop and a\n  denial of service (bsc#1264770).\n- CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability\n  of the PHPprocess (bsc#1264769).\n\nOther updates:\n\n- Updated to 8.4.21.\n","status":"published","published":"2026-05-13T08:01:02Z","modified":"2026-05-19T18:23:48.116157491Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21612-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL\n  injection (bsc#1264778).\n- CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in\n  `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777).\n- CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).\n- CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).\n- CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of\n  service (bsc#1264774).\n- CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial\n  of service (bsc#1264773).\n- CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION\n  is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).\n- CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured\n  can lead to a denial of service (bsc#1264771).\n- CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite loop and a\n  denial of service (bsc#1264770).\n- CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability\n  of the PHPprocess (bsc#1264769).\n\nOther updates:\n\n- Updated to 8.4.21.\n","status":"published","published":"2026-05-13T07:57:49Z","modified":"2026-05-16T18:23:54.211927Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}