CVE-2026-7263

Public on 2026-05-10
Modified on 2026-05-11
Description
DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core php Not Affected
Amazon Linux 2 - Php8.2 Extra php Not Affected
Amazon Linux 2 - Lamp-mariadb10.2-php7.2 Extra php No Fix Planned
Amazon Linux 2 - Php7.1 Extra php No Fix Planned
Amazon Linux 2 - Php7.2 Extra php No Fix Planned
Amazon Linux 2 - Php7.3 Extra php No Fix Planned
Amazon Linux 2 - Php7.4 Extra php No Fix Planned
Amazon Linux 2 - Php8.0 Extra php No Fix Planned
Amazon Linux 2 - Php8.1 Extra php No Fix Planned
Amazon Linux 2023 php8.1 No Fix Planned
Amazon Linux 2023 php8.2 Not Affected
Amazon Linux 2023 php8.2-pecl-apcu Not Affected
Amazon Linux 2023 php8.2-pecl-igbinary Not Affected
Amazon Linux 2023 php8.2-pecl-memcached Not Affected
Amazon Linux 2023 php8.2-pecl-msgpack Not Affected
Amazon Linux 2023 php8.2-pecl-redis6 Not Affected
Amazon Linux 2023 php8.3 Not Affected
Amazon Linux 2023 php8.4 Pending Fix
Amazon Linux 2023 php8.4-pecl-apcu Not Affected
Amazon Linux 2023 php8.4-pecl-igbinary Not Affected
Amazon Linux 2023 php8.4-pecl-memcached Not Affected
Amazon Linux 2023 php8.4-pecl-msgpack Not Affected
Amazon Linux 2023 php8.4-pecl-redis6 Not Affected
Amazon Linux 2023 php8.5 Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-7263 Mitre: CVE-2026-7263