bombobombone/cve-2026-73321Proof-of-concept and technical write-up for CVE-2026-73321, a denial-of-service vulnerability in XenForo caused by deeply nested BBCode that exhausts PHP workers.
XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode.
The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nesting limit before that work. The normal message-preparation path also processes BBCode before its final message-length validation.
On XenForo 2.3.12 (build 2031270), one guest request containing 5,000 nested [quote] tags (75,005 bytes) reset the connection. Apache recorded a Windows stack-overflow exit (0xC00000FD) for the PHP child and restarted it.
One request crashed a PHP worker. Concurrent requests temporarily exhausted the worker pool, which recovered after the requests stopped. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example 5000 --confirm-disruption
The script sends one request with a maximum depth of 5,000.
Discovered by Marco Paciaroni (BomboBombone).