XenForo 2.3.12 build 2031270 recursively parsed deeply nested BBCode before enforcing its effective depth limit. A guest request containing 5,000 nested [quote] tags caused the PHP worker to terminate with a stack overflow.
Technical details
The parser already had a maximum-depth setting, but opening tags accumulated recursively before XenForo enforced it. Normal message-length validation also happened after the parser had built and walked the nested structure.
The approximately 75 KB trigger repeated the following structure 5,000 times:
[quote][quote][quote]...[/quote][/quote][/quote]
Reproduction
- Generate 5,000 nested opening
[quote] tags followed by the matching closing tags.
- Submit the payload to the guest-accessible BBCode-to-HTML endpoint.
- Monitor the HTTP response, Apache error log, and worker process.
The request terminated the PHP worker with Windows status 0xC00000FD, the stack-overflow exception. Apache logged the exit and started a replacement worker.
Impact
An unauthenticated requester could terminate a PHP worker with one request. Concurrent requests could temporarily consume the available worker pool while Apache replaced the terminated processes.
XenForo moved the effective depth limit ahead of recursive parsing in 2.3.13.
References
XenForo 2.3.12 build 2031270 recursively parsed deeply nested BBCode before enforcing its effective depth limit. A guest request containing 5,000 nested `[quote]` tags caused the PHP worker to terminate with a stack overflow.
## Technical details
The parser already had a maximum-depth setting, but opening tags accumulated recursively before XenForo enforced it. Normal message-length validation also happened after the parser had built and walked the nested structure.
The approximately 75 KB trigger repeated the following structure 5,000 times:
```bbcode
[quote][quote][quote]...[/quote][/quote][/quote]
```
## Reproduction
1. Generate 5,000 nested opening `[quote]` tags followed by the matching closing tags.
2. Submit the payload to the guest-accessible BBCode-to-HTML endpoint.
3. Monitor the HTTP response, Apache error log, and worker process.
The request terminated the PHP worker with Windows status `0xC00000FD`, the stack-overflow exception. Apache logged the exit and started a replacement worker.
## Impact
An unauthenticated requester could terminate a PHP worker with one request. Concurrent requests could temporarily consume the available worker pool while Apache replaced the terminated processes.
XenForo moved the effective depth limit ahead of recursive parsing in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73321)
- [PoC](https://github.com/BomboBombone/CVE-2026-73321)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-uncontrolled-recursion-dos-via-bbcode-parser)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe