Description

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors rendering the affected thread.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-08T14:17:26.617Z",
  "pubdate": "2026-09-08T14:17:26.617Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are vulnerable to an uncontrolled recursion flaw within the BBCode parsing engine. This vulnerability allows an authenticated attacker to trigger a persistent denial-of-service (DoS) condition by crafting posts containing deeply nested BBCode structures. When the application attempts to render these malicious posts, the recursive depth exceeds the memory stack limits defined for the PHP interpreter. This causes fatal runtime errors, leading to the termination of PHP-FPM worker processes. Because the payload is persistent, every attempt to view the affected thread triggers the crash, effectively rendering the impacted content—and potentially the broader application—unavailable to users. The vulnerability requires authenticated access, but does not necessitate elevated administrative privileges, making it a significant availability risk for public-facing community forums running affected versions of the software.",
  "technicalDetails": "The vulnerability resides in the XenForo BBCode parser component, which fails to adequately sanitize or enforce depth constraints on nested BBCode tags during the compilation or rendering phase. In PHP-based environments, recursive function calls consume stack memory; when the depth of these calls is uncontrolled, it rapidly exhausts the allocated stack space, leading to a stack overflow or a 'Maximum function nesting level' error, depending on the PHP configuration (e.g., xdebug.max_nesting_level or internal engine limits).\nAn attacker exploits this by injecting a sequence of deeply nested, identical, or mixed BBCode tags (e.g., [b][b][b]...[/b][/b][/b]) into a forum post. When a victim or an administrator navigates to a thread containing this post, the XenForo parser initiates a recursive traversal of the node tree representing the BBCode. As the parser descends through the layers of nesting, the PHP-FPM process consumes the call stack until it hits a threshold that results in a fatal error.\nThe attack flow is as follows: 1) The attacker authenticates as a user with sufficient permissions to create or edit posts. 2) The attacker submits a specially crafted payload containing an excessive number of nested BBCode tags. 3) The server-side persistence mechanism stores this payload in the database. 4) Any subsequent request to render the post triggers the parser logic. 5) The recursive logic exceeds the PHP stack limit, causing the PHP-FPM worker responsible for that request to crash. 6) Repeated requests result in the exhaustion of the PHP-FPM pool, causing a total denial of service for the application as the worker processes are terminated.\nBecause the payload is stored persistently within the database, the denial-of-service condition is not limited to the attacker's own session; it affects any user whose request triggers the rendering of the malicious post. This necessitates immediate cleanup of the database to restore service availability once the vulnerability is identified. The vulnerability highlights a failure in input validation regarding structural complexity, specifically the lack of a depth-limiting mechanism within the parser's tree-traversal algorithm. Affected systems include all XenForo installations prior to 2.3.13, where the default parser logic handles BBCode strings without restrictive recursion limits."
}