CVE-2026-91767

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its OpenSSL extension provides the TLS layer for encrypted streams such as https://, ssl://, tls:// and ftps://, and checks that the certificate a server presents matches the host name PHP connected to.

An Out-of-Bounds Read vulnerability (CVE-2026-91767) has been identified in the php_openssl_matches_wildcard_name() function of PHP's OpenSSL extension, which allows a malicious or impersonated TLS server to present a certificate with a crafted wildcard name that makes the PHP client read far past the end of a heap buffer while verifying the peer name, which may crash the process or expose memory. PHP tracks this issue as GHSA-xr7j-rvgx-xq5p.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP before 8.2.34, PHP 8.3 before 8.3.35, PHP 8.4 before 8.4.26 and PHP 8.5 before 8.5.11, which includes every End-of-Life release line from PHP 5.6 through 8.1, each through its final release.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/openssl)
• Affected versions: <8.2.34, >=8.3.0 <8.3.35, >=8.4.0 <8.4.26, >=8.5.0 <8.5.11
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the OpenSSL extension of PHP before 8.2.34, 8.3 before 8.3.35, 8.4 before 8.4.26 and 8.5 before 8.5.11, including every End-of-Life release line from PHP 5.6 through 8.1, which never received the upstream fix. The PHP project scores it 6.5 under CVSS 3.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

When peer name verification is enabled, which is the default for client streams, PHP compares the host name it connected to with the names in the server's certificate. A certificate name may contain one * wildcard in its left-most label. php_openssl_matches_wildcard_name() checks that the text before the * (the prefix) and the text after it (the suffix) match the host name, and that no dot falls between them. In PHP 7.4.33 the function reads:

suffix_len = strlen(wildcard + 1);
subject_len = strlen(subjectname);
if (suffix_len <= subject_len) {
    /* 2) suffix must match
     * 3) no . between prefix and suffix
     **/
    return strcasecmp(wildcard + 1, subjectname + subject_len - suffix_len) == 0 &&
        memchr(subjectname + prefix_len, '.', subject_len - suffix_len - prefix_len) == NULL;
} 

Only the suffix length is compared with the host name length. When the prefix and the suffix are together longer than the host name, so that they overlap in it, for example a certificate name a*aaaa checked against the host name aaaa, the length passed to memchr() becomes negative and wraps around to a huge unsigned value. memchr() then scans far past the end of the host name's heap buffer, which can crash the process and may expose memory contents.

Exploitation needs a PHP client, under any SAPI, that opens a TLS connection with peer name verification, for example through https://, ssl://, tls:// or ftps:// streams or functions built on them, to a server that the attacker controls or can impersonate. The CVE record notes that the path is reachable from default client streams because verify_peer_name is enabled by default. Server-side TLS and builds without the OpenSSL extension are not affected.

The fix requires the prefix and the suffix to fit in the host name together, so the length passed to memchr() can no longer wrap:

suffix_len = strlen(wildcard + 1);
subject_len = strlen(subjectname);
if (suffix_len + prefix_len <= subject_len) { 

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, make TLS connections only to trusted servers over networks where an attacker cannot impersonate them.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Mohamed Sayed (flex0geek) (finder)
• Jakub Zelenka (remediation)
• Arnaud Le Blanc (remediation)