Heap Memory Vulnerability in PHP OpenSSL Affects Multiple Applications
CVE-2026-91767

6.5MEDIUM

Key Information:

Vendor

PHP Group

Status
PHP
Vendor
CVE Published:
25 September 2026

What is CVE-2026-91767?

An issue exists in the PHP OpenSSL extension where the function php_openssl_matches_wildcard_name() fails to correctly handle the length of wildcard names in TLS server certificates. When a malicious server presents such a certificate, it can lead to a condition where the PHP client reads beyond the allocated heap memory, potentially exposing sensitive data or allowing an attacker to exploit the situation. This vulnerability is reachable through any default client stream, as the parameter verify_peer_name is enabled by default, making it imperative for developers to review and mitigate risks associated with this flaw.

Affected Version(s)

PHP 8.2.* < 8.2.34

PHP 8.3.* < 8.3.35

PHP 8.4.* < 8.4.26

References

https://github.com/php/php-src/security/advisories/GHSA-x...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Sayed (flex0geek)
Jakub Zelenka
Arnaud Le Blanc
.