CVE-2026-91769
Published:September 25, 2026
Updated:October 09, 2026
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Affected Packages
https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.4.0alpha1 <php-8.4.26Fix Suggestion:
Update to version php-8.4.26https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.3.0alpha1 <php-8.3.35Fix Suggestion:
Update to version php-8.3.35https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.2.0alpha1 <php-8.2.34Fix Suggestion:
Update to version php-8.2.34https://github.com/php/php-src.git (GITHUB):
Affected version(s) >=php-8.5.0alpha1 <php-8.5.11Fix Suggestion:
Update to version php-8.5.11Related Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
ADJACENT
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Improper Validation of Certificate with Host Mismatch
EPSS
Base Score:
0.14