CVE-2026-73321

Katalog CVE

CVSS 6.5 · Medium EPSS 0,61%

Kerentanan Uncontrolled Recursion pada xenforo. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.

Rincian

Terbit di NVD

8 September 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 48,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bombobombone.github.io/posts/cve-2026-73321/ exploit · advisory pihak ketiga
• https://github.com/BomboBombone/CVE-2026-73321 exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/xenforo-uncontrolled-recursion-dos-via-bbcode-parser advisory pihak ketiga
• https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0... release notes
• https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ release notes