{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91767", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-09-15T00:41:16.041Z", "datePublished": "2026-09-25T20:53:42.587Z", "dateUpdated": "2026-09-25T20:53:42.587Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-09-25T20:53:42.587Z"}, "title": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN", "datePublic": "2026-09-25T20:49:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "packageName": "ext-openssl", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><code>php_openssl_matches_wildcard_name()</code> in <code>ext/openssl/xp_ssl.c</code> underflows the length argument passed to <code>memchr()</code> when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to <code>SIZE_MAX</code> bytes past the end of a heap allocation. The path is reachable from any default client stream, because <code>verify_peer_name</code> is enabled by default.</p>"}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Mohamed Sayed (flex0geek)", "type": "reporter"}, {"lang": "en", "value": "Jakub Zelenka", "type": "remediation developer"}, {"lang": "en", "value": "Arnaud Le Blanc", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "ext-openssl", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.2.34", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.35", "status": "affected", "version": "8.3.*", "versionType": "semver"}, {"lessThan": "8.4.26", "status": "affected", "version": "8.4.*", "versionType": "semver"}, {"lessThan": "8.5.11", "status": "affected", "version": "8.5.*", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}], "id": "CVE-2026-91767", "lastModified": "2026-09-25T21:17:24.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-09-25T21:17:24.793", "references": [{"source": "[email protected]", "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "php: php: Information disclosure via crafted TLS server certificate", "id": "2541652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541652"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in PHP. When validating secure connections using Transport Layer Security (TLS), an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue against a connecting PHP client. This flaw primarily leads to information disclosure, potentially exposing sensitive data stored in application memory."], "name": "CVE-2026-91767", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php8.4", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:7.4/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.3/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.4/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "php", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-25T20:53:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91767\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91767\nhttps://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"], "threat_severity": "Moderate"}

{"created": "2026-09-25T23:00:15.625075+00:00", "updated": "2026-09-26T02:00:02.777539+00:00", "vendors": []}