CVE-2026-73321: XenForo BBCode Parser DOS Vulnerability

CVE-2026-73321 Overview

CVE-2026-73321 is an uncontrolled recursion vulnerability [CWE-674] in the XenForo BBCode parser affecting versions before 2.3.13. Authenticated attackers can submit a single post containing deeply nested BBCode tags to trigger a fatal PHP stack overflow. Each attempt to render the affected thread crashes the PHP-FPM worker, producing a persistent denial-of-service condition for every visitor accessing the content.

The vulnerability requires only low-privileged authenticated access and no user interaction. Because the malicious content is stored, the impact persists until an administrator removes the post or applies the patch.

Critical Impact
A single authenticated post can render entire XenForo threads unusable by repeatedly terminating PHP-FPM workers for all visitors attempting to view the affected content.

Affected Products

XenForo versions 2.2.0 through 2.3.12
XenForo Media Gallery add-on versions in the same range
Fixed in XenForo 2.3.13

Discovery Timeline

2026-09-08 - CVE-2026-73321 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-73321

Vulnerability Analysis

The flaw is a denial-of-service condition caused by uncontrolled recursion in the BBCode parser. XenForo's parser walks BBCode tag trees recursively without enforcing a maximum nesting depth. When a post contains sufficiently nested tags, the parser exhausts PHP's call stack and triggers a fatal error.

Because posts are stored server-side and re-rendered on each view, every request that touches the malicious content re-enters the recursive parse and crashes the PHP-FPM worker. Cached output does not mitigate the issue for uncached views or edit previews.

Root Cause

The root cause is missing depth validation in the BBCode parsing routines. The parser treats nesting depth as unbounded and relies implicitly on PHP's runtime stack. PHP has a bounded native stack, and recursion beyond a few hundred frames produces a fatal Allowed memory size or stack overflow error that terminates the worker process.

The issue maps to CWE-674: Uncontrolled Recursion.

Attack Vector

An attacker with a standard forum account crafts a single post containing deeply nested BBCode, such as repeated [b], [quote], or [spoiler] tags. Submission succeeds because input validation does not evaluate structural depth. When any user, including anonymous visitors, loads the thread, the parser recurses through the nested structure and the worker crashes.

Subsequent renders reproduce the crash deterministically, so a single post can degrade availability of the containing thread until moderators intervene. Public technical details and a proof of concept are published in the BomboBombone CVE-2026-73321 write-up and the VulnCheck advisory on the XenForo BBCode parser DoS.

Detection Methods for CVE-2026-73321

Indicators of Compromise

PHP-FPM worker crashes with stack overflow or maximum function nesting errors correlated with requests to XenForo thread URLs.
HTTP 500 or 502 responses spiking on specific thread IDs while other threads render normally.
Forum posts containing hundreds of repeated opening BBCode tokens such as [b], [quote], [spoiler], or [list].
Web server error logs referencing the XenForo BBCode parser class in the fatal error backtrace.

Detection Strategies

Query the xf_post database table for message content with abnormally high counts of BBCode opening brackets per post.
Alert on PHP-FPM worker restart rates exceeding baseline, especially when tied to a narrow set of request URIs.
Correlate authenticated user session IDs with repeated 5xx responses on thread render endpoints to identify the submitting account.

Monitoring Recommendations

Ingest PHP-FPM and web server error logs into a centralized analytics platform and alert on recurring fatal parser errors.
Monitor XenForo administrative audit trails for newly created accounts that immediately post long-form BBCode content.
Track availability of forum thread endpoints with synthetic monitoring to identify persistent render failures.

How to Mitigate CVE-2026-73321

Immediate Actions Required

Upgrade XenForo and the Media Gallery add-on to version 2.3.13 or later without delay.
Identify and remove any posts containing deeply nested BBCode structures using database queries against xf_post.
Temporarily restrict posting privileges for newly registered accounts until the patch is deployed.
Review web server and PHP-FPM logs for prior exploitation attempts and quarantine offending user accounts.

Patch Information

XenForo released fixes in version 2.3.13. Details are available in the XenForo security fixes announcement and the XenForo 2.3.13 release notes. The patch introduces bounded recursion in the BBCode parser to prevent stack exhaustion.

Workarounds

Lower PHP's xdebug.max_nesting_level or set pcre.recursion_limit to catch runaway parser recursion before a full stack overflow occurs.
Add a web application firewall rule to reject post submissions whose body contains an excessive count of repeated BBCode opening tokens.
Disable BBCode tags most prone to nesting abuse, such as [quote] and [spoiler], for untrusted user groups until patching completes.

bash

# Example WAF rule concept: reject posts with more than 100 nested [quote] tags
# ModSecurity rule
SecRule REQUEST_BODY "@rx (\[quote[^\]]*\]){100,}" \
    "id:1073321,phase:2,deny,status:403,msg:'CVE-2026-73321 nested BBCode DoS attempt'"