This vulnerability involves improper resource shutdown or release (CWE-404) and potentially infinite loop conditions (CWE-835) in the PHP DOMNode::C14N() method. When processing certain XML data, the method may create a circular linked list within the internal representation of the XML document. This structural corruption can cause subsequent XML processing to hang indefinitely, leading to denial of service in applications using affected PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6. The CVSS 4.0 base score is 6.3, indicating medium severity with network attack vector, low attack complexity, and partial remediation required.

Successful exploitation can cause denial of service by making the XML processing enter an infinite loop, potentially causing application unavailability. There is no indication of privilege escalation, data disclosure, or code execution. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor PHP Group advisories for updates addressing this issue. Until a patch is available, consider limiting exposure to untrusted XML input or applying application-level controls to mitigate denial of service risks related to XML processing.