CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

Published Sep 24, 2026
·
Updated

Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)

Other sources

Heap-buffer-overflow in phpopensslmatcheswildcardname on crafted server cert wildcard CN

— Microsoft

phpopensslmatcheswildcardname() in ext/openssl/xpssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZEMAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verifypeername is enabled by default.

— MITRE

Affected Software

34 affected componentsFixes available
PHP PHP<8.4.26
8.4.26
Microsoft azl3 php 8.3.33-1<8.3.35-1
8.3.35-1
PHP PHP>=8.2.0<8.2.34
PHP PHP>=8.3.0<8.3.35
PHP PHP>=8.4.0<8.4.26
PHP PHP>=8.5.0<8.5.11
bitnami/libphp>=8.2.0<8.2.34
8.2.34
bitnami/libphp>=8.3.0<8.3.35
8.3.35
bitnami/libphp>=8.4.0<8.4.26
8.4.26
bitnami/libphp>=8.5.0<8.5.11
8.5.11
bitnami/php>=8.2.0<8.2.34
8.2.34
bitnami/php>=8.3.0<8.3.35
8.3.35
bitnami/php>=8.4.0<8.4.26
8.4.26
bitnami/php>=8.5.0<8.5.11
8.5.11
bitnami/php-min>=8.2.0<8.2.34
8.2.34
bitnami/php-min>=8.3.0<8.3.35
8.3.35
bitnami/php-min>=8.4.0<8.4.26
8.4.26
bitnami/php-min>=8.5.0<8.5.11
8.5.11
ubuntu/php7.0<7.0.33-0ubuntu0.16.04.16+esm21
7.0.33-0ubuntu0.16.04.16+esm21
ubuntu/php7.2<7.2.24-0ubuntu0.18.04.17+esm13
7.2.24-0ubuntu0.18.04.17+esm13
ubuntu/php7.4<7.4.3-4ubuntu2.29+esm4
7.4.3-4ubuntu2.29+esm4
ubuntu/php8.1<8.1.2-1ubuntu2.27
8.1.2-1ubuntu2.27
ubuntu/php8.3<8.3.6-0ubuntu0.24.04.12
8.3.6-0ubuntu0.24.04.12
ubuntu/php8.5<8.5.9-0ubuntu2
8.5.9-0ubuntu2
ubuntu/php8.5<8.5.4-0ubuntu1.4
8.5.4-0ubuntu1.4
alpine/php82<8.2.35-r0
8.2.35-r0
alpine/php83<8.3.36-r0
8.3.36-r0
alpine/php83<8.3.36-r0
8.3.36-r0
alpine/php83<8.3.35-r0
8.3.35-r0
alpine/php84<8.4.27-r0
8.4.27-r0
alpine/php84<8.4.27-r0
8.4.27-r0
alpine/php84<8.4.26-r0
8.4.26-r0
alpine/php85<8.5.12-r0
8.5.12-r0
alpine/php85<8.5.11-r0
8.5.11-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.4.26
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.3.35-1
  3. Upgrade

    Upgrade bitnami/libphp to a version that resolves this vulnerability.

    Fixed in 8.2.34
  4. Upgrade

    Upgrade bitnami/libphp to a version that resolves this vulnerability.

    Fixed in 8.3.35
  5. Upgrade

    Upgrade bitnami/libphp to a version that resolves this vulnerability.

    Fixed in 8.4.26
  6. Upgrade

    Upgrade bitnami/libphp to a version that resolves this vulnerability.

    Fixed in 8.5.11
  7. Upgrade

    Upgrade bitnami/php to a version that resolves this vulnerability.

    Fixed in 8.2.34
  8. Upgrade

    Upgrade bitnami/php to a version that resolves this vulnerability.

    Fixed in 8.3.35
  9. Upgrade

    Upgrade bitnami/php to a version that resolves this vulnerability.

    Fixed in 8.4.26
  10. Upgrade

    Upgrade bitnami/php to a version that resolves this vulnerability.

    Fixed in 8.5.11
  11. Upgrade

    Upgrade bitnami/php-min to a version that resolves this vulnerability.

    Fixed in 8.2.34
  12. Upgrade

    Upgrade bitnami/php-min to a version that resolves this vulnerability.

    Fixed in 8.3.35
  13. Upgrade

    Upgrade bitnami/php-min to a version that resolves this vulnerability.

    Fixed in 8.4.26
  14. Upgrade

    Upgrade bitnami/php-min to a version that resolves this vulnerability.

    Fixed in 8.5.11
  15. Upgrade

    Upgrade ubuntu/php7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.33-0ubuntu0.16.04.16+esm21
  16. Upgrade

    Upgrade ubuntu/php7.2 to a version that resolves this vulnerability.

    Fixed in 7.2.24-0ubuntu0.18.04.17+esm13
  17. Upgrade

    Upgrade ubuntu/php7.4 to a version that resolves this vulnerability.

    Fixed in 7.4.3-4ubuntu2.29+esm4
  18. Upgrade

    Upgrade ubuntu/php8.1 to a version that resolves this vulnerability.

    Fixed in 8.1.2-1ubuntu2.27
  19. Upgrade

    Upgrade ubuntu/php8.3 to a version that resolves this vulnerability.

    Fixed in 8.3.6-0ubuntu0.24.04.12
  20. Upgrade

    Upgrade ubuntu/php8.5 to a version that resolves this vulnerability.

    Fixed in 8.5.9-0ubuntu2
  21. Upgrade

    Upgrade ubuntu/php8.5 to a version that resolves this vulnerability.

    Fixed in 8.5.4-0ubuntu1.4

Event History

Sep 24, 2026
CVE Published
via PHP·12:00 AM
Data Sourced
via PHP·12:00 AM
DescriptionAffected Software
Sep 25, 2026
CVE Published
via MITRE·08:53 PM
Data Sourced
via MITRE·08:53 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
Affected Software
Sep 28, 2026
Data Sourced
via Microsoft·06:23 AM
DescriptionSeverityWeaknessAffected Software
Oct 1, 2026
Advisory Published
via OSV·09:29 AM

Frequently Asked Questions

1

What input is involved in triggering the overflow?

The issue is triggered by a crafted server certificate containing a wildcard common name (CN).

2

Which PHP component contains the vulnerable code?

The overflow is in php_openssl_matches_wildcard_name(), indicating the affected code is part of PHP's OpenSSL-related certificate hostname wildcard matching.

3

Is the vulnerability fixed?

Yes. The provided information states that the heap buffer overflow is fixed, and references the PHP 8.3.35 changelog.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203