The vulnerability CVE-2026-7263 affects PHP versions 8.4.* prior to 8.4.21 and 8.5.* prior to 8.5.6. It involves the DOMNode::C14N() method improperly handling XML data, which can lead to the creation of a circular linked list within the XML document's internal data structure. This malformed structure can cause subsequent XML processing to enter an infinite loop, resulting in a denial of service condition. The issue is categorized under CWE-404 (Improper Resource Shutdown or Release) and CWE-835 (Loop with Unreachable Exit Condition). Red Hat has published security advisories and errata (RHSA-2026:22649) that provide updated PHP packages fixing this vulnerability. The fix is included in PHP 8.4.21 and later versions. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability can cause denial of service by triggering infinite loops during XML processing in affected PHP versions. This can disrupt availability of applications relying on the vulnerable DOMNode::C14N() method. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and partial impact on availability.

A fix is available and included in PHP versions 8.4.21 and 8.5.6 and later. Users should apply these official updates as provided by their vendor or distribution, such as the Red Hat Enterprise Linux security update RHSA-2026:22649. There is no indication that additional mitigation steps beyond patching are required. Patch status is confirmed by the vendor advisory.