The vulnerability arises from unbounded recursion in the cleanup_xml_node() function within the PHP SOAP XML parser. This function recurses once per XML nesting level without any limit, allowing an attacker to craft SOAP requests with tens of thousands of nested elements. When such a request is processed by any SoapServer endpoint, it exhausts the stack and causes the process to crash. The same pattern of unbounded recursion is present in the SOAP value decoder and the WSDL node search helper, potentially broadening the attack surface within SOAP handling in PHP.

An unauthenticated remote attacker can cause a denial of service (DoS) by crashing the SoapServer process through stack exhaustion. There is no impact on confidentiality or integrity, but availability is severely affected due to process crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the depth of XML parsing or restricting access to SOAP endpoints to trusted clients to reduce exposure.