Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-91767

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

Default version status: unaffected

  • 8.2.* to < 8.2.34affected
  • 8.3.* to < 8.3.35affected
  • 8.4.* to < 8.4.26affected
  • 8.5.* to < 8.5.11affected

References