CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)
Other sources
Heap-buffer-overflow in phpopensslmatcheswildcardname on crafted server cert wildcard CN
— Microsoft
phpopensslmatcheswildcardname() in ext/openssl/xpssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZEMAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verifypeername is enabled by default.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Frequently Asked Questions
What input is involved in triggering the overflow?
The issue is triggered by a crafted server certificate containing a wildcard common name (CN).
Which PHP component contains the vulnerable code?
The overflow is in php_openssl_matches_wildcard_name(), indicating the affected code is part of PHP's OpenSSL-related certificate hostname wildcard matching.
Is the vulnerability fixed?
Yes. The provided information states that the heap buffer overflow is fixed, and references the PHP 8.3.35 changelog.