CVE-2026-91767

MediumCVSS 6.5/10Last modified Oct 27, 2026

Description

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
PHP Group	PHP	>= 8.2., < 8.2.34; >= 8.3., < 8.3.35; >= 8.4., < 8.4.26; >= 8.5., < 8.5.11

References

https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5pVendor Advisory

Timeline

Published: Sep 25, 2026
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-917686.5The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients mat CVE-2026-917694.3PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to t CVE-2026-91779.4A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport produc CVE-2026-917706.5IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any CVE-2026-917718.8Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path trav CVE-2026-917726.1Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query paramet CVE-2026-917734.3Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadat CVE-2026-917744.3Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team CVE-2026-917757.4LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying impor CVE-2026-917767.5TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied typ CVE-2026-917777.5Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference CVE-2026-917787.2In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the