CVE-2026-91767
published 2026-09-25CVE-2026-91767: php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard…
PriorityP431medium6.5CVSS 3.1
AVAACLPRNUINSUCHINAN
EPSS
0.10%
1.1th percentile
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_8.4 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.34 | 8.2.34 |
| php_group | php | >= 8.3.* < 8.3.35 | 8.3.35 |
| php_group | php | >= 8.4.* < 8.4.26 | 8.4.26 |
| php_group | php | >= 8.5.* < 8.5.11 | 8.5.11 |
| ubuntu | php5 | — | — |
| ubuntu | php7.0 | — | — |
| ubuntu | php7.2 | — | — |
| ubuntu | php7.4 | — | — |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
vendor_ubuntu3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 3.4
CVE-2026-93682 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP did not properly validate the size of MySQL
server packets in the mysqlnd driver. A malicious server could possibly use
this issue to cause PHP to crash, resulting in a denial of service. This
issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)
It was discovered that PHP incorrectly handled response buffer sizes in the
SOAP HTTP client. A malicious server could possibly use this issue to cause
PHP to crash, resulting in a denial of service, or execute arbitrary code.
(CVE-2025-14181)
It was discovered that PHP incorrectly handled certain TAR archive headers
in the Phar extension. An attacker could pos
Red Hat
php: php: Information disclosure via crafted TLS server certificate
vendor_redhat·2026-09-25·CVSS 6.5
CVE-2026-91767 [MEDIUM] CWE-125 php: php: Information disclosure via crafted TLS server certificate
php: php: Information disclosure via crafted TLS server certificate
A flaw was found in PHP. When validating secure connections using Transport Layer Security (TLS), an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue against a connecting PHP client. This flaw primarily leads to information disclosure, potentially exposing sensitive data stored in application memory.
Package: php (Red Hat Enterprise Linux 10) - Fix deferred
Package: php8.4 (Red Hat Enterprise Linux 10) - Fix deferred
Package: php (Red Hat Enterprise Linux 6) - Out of support scope
Package: php (Red Hat Enterprise Linux 7) - Fix deferred
Package: php:7.4/php (Red Hat Ente
VulDB
PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 OpenSSL ext/openssl/xp_ssl.c php_openssl_matches_wildcard_name length heap-based overflow
vuldb·2026-09-25·CVSS 6.5
CVE-2026-91767 [MEDIUM] PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 OpenSSL ext/openssl/xp_ssl.c php_openssl_matches_wildcard_name length heap-based overflow
A vulnerability has been found in PHP up to 8.2.33/8.3.34/8.4.25/8.5.10 and classified as critical. This issue affects the function php_openssl_matches_wildcard_name of the file ext/openssl/xp_ssl.c of the component OpenSSL. Performing a manipulation of the argument length results in heap-based buffer overflow.
This vulnerability is cataloged as CVE-2026-91767. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-91767 php: php: Information disclosure via crafted TLS server certificate [fedora-all]
bugzilla·2026-10-14·CVSS 6.5
CVE-2026-91767 [MEDIUM] CVE-2026-91767 php: php: Information disclosure via crafted TLS server certificate [fedora-all]
CVE-2026-91767 php: php: Information disclosure via crafted TLS server certificate [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
Bugzilla
CVE-2026-91767 php: php: Information disclosure via crafted TLS server certificate
bugzilla·2026-09-25·CVSS 6.5
CVE-2026-91767 [MEDIUM] CVE-2026-91767 php: php: Information disclosure via crafted TLS server certificate
CVE-2026-91767 php: php: Information disclosure via crafted TLS server certificate
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
2026-09-25
Published