CVE-2026-73321

XenForo before 2.3.13 is vulnerable to uncontrolled recursion (CWE-674) in its BBCode parser, which can exhaust PHP's call stack. An authenticated attacker with posting privileges submits a single post containing BBCode tags nested deeply enough to exceed PHP's stack limit. Whenever that thread is subsequently rendered, the parser triggers fatal PHP errors that repeatedly terminate PHP-FPM workers, creating a persistent denial of service for every visitor to the thread; only availability is impacted, with no confidentiality or integrity loss per the CVSS 4.0 score of 7.1 (High). All XenForo forums running versions prior to 2.3.13 are affected, and because exploitation requires only a low-privileged forum account, any community that permits member posting is exposed. No confirmed in-the-wild exploitation exists at this time: one public proof-of-concept is available on GitHub, EPSS estimates the 30-day exploitation probability at 0.4% (31st percentile), and the CVE is not in CISA's KEV catalog.

What to do: Upgrade to XenForo 2.3.13 or later. Until patched, restrict posting to trusted accounts, cap BBCode nesting depth (e.g., via WAF rules or BBCode configuration), and monitor PHP-FPM logs for repeated worker crashes. If a malicious deeply nested post is discovered, delete or edit it to restore normal rendering of the affected thread.