The flaw occurs in PHP’s DOMNode::C14N() method, which can create an unintended circular linked list when processing certain XML inputs. This causes subsequent XML processing to enter an infinite loop, exhausting CPU resources and rendering the application unresponsive. The vulnerability is documented as CWE‑404 (Improper Handling of Resource) and CWE‑835 (Infinite Loop). The effect is purely a denial of service; the attacker can interrupt the normal operation of any application that relies on SOAP or XML parsing through this method.

PHP versions 8.4.* prior to 8.4.21 and 8.5.* prior to 8.5.6 are vulnerable. The affected product is the PHP runtime provided by the PHP Group.

The CVSS score is 6.3, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is application‑level, where an attacker supplies crafted XML data to an endpoint that uses DOMNode::C14N(). Because the fault causes an infinite loop, an attacker could trigger a denial of service on the host running PHP. no prerequisite for code execution is required, and the impact is confined to the affected application or server.