Name: CVE-2026-7263: Improper Resource Shutdown or Release
Creator: Rapid7
Published: 2026-05-10T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-7263, CWE-835, CWE-404, CVSS 7.5, EPSS 0.00353

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

CVSS Details

CVSS 4.0 Base Score: 6.3 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:Amber)
CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade php84Upgrade php85	May 15, 2026	May 10, 2026
Amazon_linux_2023	—	Upgrade php8.5-debuginfoUpgrade php8.5-modphpUpgrade php8.5-mysqlndUpgrade php8.5-cliUpgrade php8.4-cliUpgrade php8.5-enchant-debuginfoUpgrade php8.4-soapUpgrade php8.5-dbaUpgrade php8.4-odbc-debuginfoUpgrade php8.5-dba-debuginfoUpgrade php8.5-gd-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.5-zipUpgrade php8.4-pgsql-debuginfoUpgrade php8.4Upgrade php8.5-tidy-debuginfoUpgrade php8.4-sodiumUpgrade php8.5-common-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.5-dbg-debuginfoUpgrade php8.4-odbcUpgrade php8.4-ldap-debuginfoUpgrade php8.4-embeddedUpgrade php8.4-ffiUpgrade php8.4-xmlUpgrade php8.5-soap-debuginfoUpgrade php8.4-tidyUpgrade php8.5-ldap-debuginfoUpgrade php8.5-embedded-debuginfoUpgrade php8.5-cli-debuginfoUpgrade php8.4-debugsourceUpgrade php8.5-debugsourceUpgrade php8.4-sodium-debuginfoUpgrade php8.5-gmpUpgrade php8.5-bcmathUpgrade php8.5-mysqlnd-debuginfoUpgrade php8.4-pdoUpgrade php8.4-cli-debuginfoUpgrade php8.4-gmpUpgrade php8.4-intl-debuginfoUpgrade php8.5-snmpUpgrade php8.5-develUpgrade php8.5-pgsql-debuginfoUpgrade php8.4-mysqlndUpgrade php8.5-sodium-debuginfoUpgrade php8.4-ldapUpgrade php8.4-fpmUpgrade php8.4-fpm-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.5-snmp-debuginfoUpgrade php8.4-gdUpgrade php8.5-sodiumUpgrade php8.5-ffiUpgrade php8.4-soap-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.4-dbgUpgrade php8.5-zip-debuginfoUpgrade php8.5-intl-debuginfoUpgrade php8.5-intlUpgrade php8.5-fpm-debuginfoUpgrade php8.5-commonUpgrade php8.4-opcacheUpgrade php8.4-intlUpgrade php8.4-gmp-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.5-tidyUpgrade php8.5-bcmath-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php8.4-enchantUpgrade php8.4-snmpUpgrade php8.4-modphp-debuginfoUpgrade php8.5-process-debuginfoUpgrade php8.5-processUpgrade php8.5-fpmUpgrade php8.5-embeddedUpgrade php8.4-zipUpgrade php8.4-commonUpgrade php8.5-gmp-debuginfoUpgrade php8.4-zip-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.5Upgrade php8.4-pgsqlUpgrade php8.4-develUpgrade php8.4-bcmathUpgrade php8.5-xml-debuginfoUpgrade php8.5-ldapUpgrade php8.5-odbc-debuginfoUpgrade php8.4-dbaUpgrade php8.5-xmlUpgrade php8.4-debuginfoUpgrade php8.5-dbgUpgrade php8.4-pdo-debuginfoUpgrade php8.5-soapUpgrade php8.5-pdo-debuginfoUpgrade php8.5-odbcUpgrade php8.5-pdoUpgrade php8.5-mbstring-debuginfoUpgrade php8.4-processUpgrade php8.5-ffi-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-modphpUpgrade php8.5-mbstringUpgrade php8.4-dbg-debuginfoUpgrade php8.4-tidy-debuginfoUpgrade php8.4-dba-debuginfoUpgrade php8.5-enchantUpgrade php8.5-gdUpgrade php8.4-bcmath-debuginfoUpgrade php8.5-modphp-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.5-pgsql	May 28, 2026	May 10, 2026
Debian	—	Upgrade php8.4	Jul 23, 2026	Jul 23, 2026
Oracle_linux	—	Upgrade php8.4-mysqlndUpgrade php8.4-embeddedUpgrade php8.4-ldapUpgrade php8.4-gmpUpgrade php8.4-ffiUpgrade php8.4-gdUpgrade php8.4-snmpUpgrade php8.4-enchantUpgrade php8.4-bcmathUpgrade php8.4-pgsqlUpgrade php8.4-fpmUpgrade php8.4-xmlUpgrade php8.4-commonUpgrade php8.4-pdoUpgrade php8.4-processUpgrade php8.4-dbaUpgrade php8.4-cliUpgrade php8.4-opcacheUpgrade php8.4-soapUpgrade php8.4-odbcUpgrade php8.4-mbstringUpgrade php8.4-dbgUpgrade php8.4-intlUpgrade php8.4-develUpgrade php8.4	Oct 22, 2026	May 10, 2026
Redhat_linux	—	Upgrade php8.4-odbc-debuginfoUpgrade php8.4-ffiUpgrade php8.4-pdoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.4-snmpUpgrade php8.4-gmpUpgrade php8.4-dbaUpgrade php8.4-mbstringUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-ldapUpgrade php8.4-xmlUpgrade php8.4-gmp-debuginfoUpgrade php8.4-debugsourceUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-fpmUpgrade php8.4-cliUpgrade php8.4-common-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.4-mysqlndUpgrade php8.4-dbg-debuginfoUpgrade php8.4-develUpgrade php8.4-commonUpgrade php8.4-pdo-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-processUpgrade php8.4-snmp-debuginfoUpgrade php8.4-enchantUpgrade php8.4-bcmathUpgrade php8.4-dba-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.4-soapUpgrade php8.4-gdUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-dbgUpgrade php8.4Upgrade php8.4-ldap-debuginfoUpgrade php8.4-intlUpgrade php8.4-embeddedUpgrade php8.4-opcacheUpgrade php8.4-odbcUpgrade php8.4-debuginfo	Jun 4, 2026	May 10, 2026
Rocky_linux	—	Upgrade php8.4-pdo-debuginfoUpgrade php8.4-fpmUpgrade php8.4-dbg-debuginfoUpgrade php8.4-dba-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.4-gdUpgrade php8.4-odbcUpgrade php8.4-intl-debuginfoUpgrade php8.4-dbaUpgrade php8.4-xmlUpgrade php8.4-ffiUpgrade php8.4-snmpUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-commonUpgrade php8.4-embeddedUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-cliUpgrade php8.4-intlUpgrade php8.4-debugsourceUpgrade php8.4-bcmathUpgrade php8.4-ldapUpgrade php8.4-soapUpgrade php8.4-snmp-debuginfoUpgrade php8.4-pdoUpgrade php8.4-embedded-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-develUpgrade php8.4-xml-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-enchantUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.4-dbgUpgrade php8.4-gmp-debuginfoUpgrade php8.4-mysqlndUpgrade php8.4-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-gmpUpgrade php8.4-processUpgrade php8.4Upgrade php8.4-opcache	Jun 8, 2026	Jun 5, 2026
Ubuntu	—	Upgrade php8.1Upgrade php8.5Upgrade php8.4Upgrade php8.3	May 28, 2026	May 28, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence