blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2026-91769

MEDIUM 4.3 CVSS 3.1
Published
September 25, 2026
Last modified
October 23, 2026
NVD status
Analyzed
Reported by
security@php.net
Weakness
CWE-297
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

Affected products and versions

  • PHP — From 8.2.0 (including) to 8.2.34 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.35 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.26 (excluding)
  • PHP — From 8.5.0 (including) to 8.5.11 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx Vendor Advisory, Exploit
  • nvd.nist.gov Official NVD record