CVE-2026-91767

Received Received - Intake

PHP Client Heap Overflow via Wildcard Certificate Validation

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: PHP Group

Description

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-91767

Affected Vendors & Products

Vendor	Product	Version / Range
php	php	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in PHP's OpenSSL extension where php_openssl_matches_wildcard_name() incorrectly handles wildcard certificates. When a server's certificate has a wildcard name longer than the hostname being verified, it causes memchr() to read beyond allocated memory, potentially exposing sensitive data.

Detection Guidance

This vulnerability is specific to PHP's OpenSSL implementation and requires checking PHP versions and OpenSSL certificate handling. No direct network or system commands are provided in the context to detect this issue. Review PHP and OpenSSL configurations for wildcard certificate validation.

Impact Analysis

An attacker could exploit this to read memory contents from the PHP client, leading to information disclosure. Since the path is reachable via default client streams, any PHP application using OpenSSL for TLS verification is potentially affected.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance failures if exploited, resulting in legal or regulatory penalties.

Mitigation Strategies

Update PHP to the latest patched version to address the memchr() underflow issue in php_openssl_matches_wildcard_name(). Disable client-side certificate verification if not required, as the vulnerability is reachable through default client streams with verify_peer_name enabled.

Hi! I’m here to help you understand CVE-2026-91767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70