Description (CNA)
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PHP Group / PHP | affected 8.4.* before 8.4.21; affected 8.5.* before 8.5.6 |
CWE
CWE-404, CWE-835
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in PHP. The `DOMNode::C14N()` method may incorrectly process XML data due to the improper removal of an `xmlns` attribute from the underlying libxml2 data structure, corrupting the linked list representing the XML document and causing an infinite loop. This issue can lead to excessive resource consumption, eventually resulting in a denial of service in the processing application.