CVE-2026-91767
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation.
Risk Assessment
This can lead to application crashes, memory disclosure, or potential remote code execution, as the path is reachable from any default client stream.
Recommendation
Update PHP to a version containing the fix or disable peer name verification if possible, though this is not recommended for security reasons.
Other vulnerabilities in PHP OpenSSL
Original NVD description (English source)
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS