CVE-2026-29079: 
PHP vulnerability analysis and mitigation

CVE-2026-29079 is a type-confusion vulnerability in Lexbor's HTML fragment parser that can cause a denial of service via memory corruption. When the namespace (ns) is set to UNDEF, a comment node is incorrectly created using the "unknown element" constructor, causing comment data to be written into element fields via an unsafe cast. This corrupts the qualified_name field, which is subsequently used as a pointer and dereferenced near the zero page. All Lexbor versions prior to 2.7.0 are affected; the vulnerability was disclosed on March 13, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-843 (Access of Resource Using Incompatible Type / Type Confusion). In Lexbor's HTML fragment parser, when processing HTML with an undefined namespace (ns = UNDEF), the parser incorrectly instantiates a comment node using the "unknown element" constructor. The comment's data fields are then written into element-specific fields via an unsafe C-style cast, corrupting the qualified_name field. The corrupted value is later treated as a valid pointer and dereferenced near the zero page (address ~0x0), triggering a crash. The vulnerability was discovered by Nikita Sveshnikov of Positive Technologies and requires no authentication or user interaction to trigger, though specific attack requirements (e.g., the ability to supply crafted HTML to the parser) must be present (GitHub Advisory).

Successful exploitation results in a denial of service (DoS) condition — specifically, a crash of any application that uses Lexbor to parse attacker-controlled HTML input. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Applications embedding Lexbor as an HTML parsing library (including PHP, which bundles Lexbor) are at risk of process crashes when processing malicious HTML fragments (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is network-accessible and requires no privileges or user interaction, but does require specific attack conditions (crafted HTML input reaching the parser). No threat actor attribution or CISA KEV catalog listing has been identified.

1. Identify target: Locate an application or service that uses Lexbor prior to version 2.7.0 to parse HTML input (e.g., a PHP application using the Dom extension, which bundles Lexbor).
2. Craft malicious HTML: Construct an HTML fragment that triggers the undefined namespace (ns = UNDEF) code path in Lexbor's fragment parser — for example, by supplying a comment node within a context that causes the parser to use the "unknown element" constructor.
3. Submit input: Deliver the crafted HTML to the target application via any input channel that passes data to Lexbor's HTML fragment parser (e.g., an HTTP request body, form field, or API endpoint).
4. Trigger type confusion: The parser writes comment data into element fields via an unsafe cast, corrupting the qualified_name field.
5. Achieve DoS: The corrupted pointer is dereferenced near the zero page, causing a segmentation fault and crashing the host process (GitHub Advisory).

• Process: Unexpected crashes or segmentation faults in applications embedding Lexbor (e.g., PHP-FPM worker processes, web servers using Lexbor-based HTML parsing).
• Logs: Crash reports or core dumps referencing a null or near-zero pointer dereference in Lexbor's HTML parser code paths; PHP error logs showing fatal errors during HTML DOM parsing.
• Network: Repeated HTTP requests containing unusual or malformed HTML comment structures submitted to endpoints that perform server-side HTML parsing.

The vulnerability is fixed in Lexbor version 2.7.0. Organizations should upgrade Lexbor to 2.7.0 or later as the primary remediation. Downstream consumers such as PHP (which bundles Lexbor) should apply updated PHP releases that incorporate the patched Lexbor version — a relevant PHP commit addressing this issue has been identified (PHP commit). Fedora and other Linux distributions have also issued package updates. As a temporary workaround where patching is not immediately possible, restrict or sanitize HTML input before it reaches the Lexbor parser (GitHub Advisory).

The vulnerability was discovered by Nikita Sveshnikov of Positive Technologies and responsibly disclosed to the Lexbor maintainers, resulting in the release of version 2.7.0 (GitHub Advisory). Downstream Linux distributions including Fedora have issued security updates for affected packages such as PHP. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.