This vulnerability affects the DOMNode::C14N() method in PHP versions 8.4.* prior to 8.4.21 and 8.5.* prior to 8.5.6. The method may mishandle XML data, leading to the creation of a circular linked list within the internal data structure representing the XML document. This structural corruption can cause subsequent XML processing to enter an infinite loop, effectively causing a denial of service in applications that parse XML using this method. The CVSS 4.0 base score is 6.3, indicating a medium severity level. The vulnerability is categorized under CWE-404 (Improper Resource Shutdown or Release) and CWE-835 (Loop with Unreachable Exit Condition). No patch or official remediation level is provided in the available data.

Successful exploitation of this vulnerability can cause denial of service by making the XML processing enter an infinite loop, which may hang or crash the application relying on PHP's DOMNode::C14N() method. There is no indication of privilege escalation, data disclosure, or code execution impacts. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider avoiding the use of DOMNode::C14N() on untrusted XML data or implement application-level timeouts or resource limits on XML processing to mitigate potential denial of service. Monitor official PHP Group advisories for updates and patches addressing this vulnerability.