CVE-2026-91767
Description
A flaw was found in PHP. When validating secure connections using Transport Layer Security (TLS), an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue against a connecting PHP client. This flaw primarily leads to information disclosure, potentially exposing sensitive data stored in application memory.
Statement
This vulnerability is rated Moderate because a PHP TLS client that verifies peer names can suffer an out-of-bounds read when a server presents a crafted wildcard certificate, crashing the client process (denial of service). The GHSA analysis indicates the scan result is used only for accept/reject and is not returned to the attacker, so Red Hat scores availability impact without confidentiality impact. Exploitation requires the client to connect to a server that can present such a certificate (malicious server or compromised/trusted CA path).
Mitigation
Restrict outbound TLS connections from PHP applications to trusted servers and certificate authorities. Do not disable verify_peer_name as a workaround except after an explicit risk review.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Adjacent Network | N/A | Adjacent Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
Adjacent TLS server presents crafted wildcard CN; OOB read in php_openssl_matches_wildcard_name causes client crash/DoS. GHSA notes scan result is not returned to the attacker, so no confidentiality impact for Red Hat scoring.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
