CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch
Fixed (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)
Other sources
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peername. A certificate trusted by the client for one name can therefore be used to impersonate another.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Frequently Asked Questions
Which PHP release documentation should be checked to verify this fix?
The provided reference points to the PHP 8.3.35 changelog. The available data does not identify affected version ranges or fixes in other release branches.