CVE-2026-91765 PHP Group CVE debrief

Who should care

Defenders responsible for systems using the affected SOAP XML parser should assess exposure and prioritize patching or mitigating this vulnerability. They should also verify exploitation and remediation details, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-91765 is a high-severity vulnerability in the SOAP XML parser that can cause a denial of service. Defenders should assess exposure, prioritize patching or mitigation, and verify exploitation and remediation details.

• Denial of service through process crash
• Potential for exploitation requires verification
• Remediation priority requires verification
• Exposure assessment is necessary

Technical summary

The SOAP XML parser in the affected system has an unbounded recursion vulnerability. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The vulnerability affects systems using the affected SOAP XML parser, and defenders should assess exposure and prioritize patching or mitigation. The official CVE record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. However, details on affected scope, severity, and vendor guidance require review of the official advisory.

Defensive priority

Defenders should prioritize verifying and patching affected systems, especially those exposed to untrusted input.

Recommended defensive actions

• Verify and apply patches for affected systems
• Restrict access to SoapServer endpoints
• Monitor for suspicious SOAP requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the CVE Program and NVD indicates that the SOAP XML parser has an unbounded recursion vulnerability, which can be exploited to cause a denial of service. The official CVE record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. However, details on affected scope, severity, and vendor guidance require review of the official advisory. Defenders should verify and patch affected systems, especially those exposed to untrusted input, and monitor for suspicious SOAP requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.