An unbounded recursion flaw exists in the SOAP XML parser’s cleanup_xml_node function, which recurses once per XML nesting level with no depth guard. Once triggered, the recursion consumes stack memory rapidly, causing the SoapServer process to crash. The vulnerability can lead to service outage for any application relying on the SOAP extension, with no persistence or confidentiality compromise. The weakness is an uncontrolled recursion condition.

Products affected are PHP distributions from the PHP Group. The flaw surfaces in the SOAP XML parser, SOAP value decoder, and WSDL node search helper, impacting any PHP installation that has the SOAP extension enabled and exposes a SoapServer endpoint.

The CVSS score of 7.5 indicates a high severity due to the crash risk, and the EPSS score is unavailable, but the KEV status indicates it is not listed in CISA’s catalog yet. Attacks require no authentication and leverage any publicly reachable SoapServer endpoint. An attacker can craft a SOAP request with thousands of nested elements, causing the server to run out of stack space and terminate. Control of the target system is not required; simply sending the malicious request suffices to disrupt service.