CVE-2026-73321 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
Authenticated attackers can cause persistent denial of service by submitting posts with deeply nested BBCode tags, crashing PHP workers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73321?
CVE-2026-73321 is a high-severity denial of service vulnerability in XenForo, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.
Weakness: CWE-674
Which versions are affected by CVE-2026-73321?
It affects 1 product.
Products include Xenforo Xenforo.
How do I fix CVE-2026-73321?
No fix has been published for CVE-2026-73321 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73321 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73321 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in XenForo
- CVE-2025-71279 XenForo Passkey Security Bypass
- CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
- CVE-2026-73311 XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
- CVE-2024-38457 Xenforo before 2.2.16 allows CSRF.
Sources
Also known as GHSA-vv8x-44ww-j3wh.