UBUNTU-CVE-2026-91767: Medium severity ubuntu/php7.0 vulnerability

Q: Which PHP clients are exposed to this issue?

Any affected PHP client that uses a default TLS stream is exposed, because peer-name verification is enabled by default. The listed Ubuntu PHP packages are php7.0, php7.2, php7.4, php8.1, php8.3, and php8.5.

Q: What must an attacker control to trigger the flaw?

An attacker must operate or impersonate a TLS server contacted by the PHP client and present a certificate containing a wildcard name whose literal characters are longer than the hostname being verified. No authentication or user interaction is required.

Q: What is the impact if exploitation succeeds?

The PHP client can read beyond the end of a heap allocation, potentially reading up to SIZE_MAX bytes past it. The reported impact is high confidentiality impact, with no reported integrity or availability impact.

Published Sep 25, 2026

Updated

phpopensslmatcheswildcardname() in ext/openssl/xpssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZEMAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verifypeername is enabled by default.

Affected Software

7 affected componentsFixes available

ubuntu/php7.0<7.0.33-0ubuntu0.16.04.16+esm21

7.0.33-0ubuntu0.16.04.16+esm21

ubuntu/php7.2<7.2.24-0ubuntu0.18.04.17+esm13

7.2.24-0ubuntu0.18.04.17+esm13

ubuntu/php7.4<7.4.3-4ubuntu2.29+esm4

7.4.3-4ubuntu2.29+esm4

ubuntu/php8.1<8.1.2-1ubuntu2.27

8.1.2-1ubuntu2.27

ubuntu/php8.3<8.3.6-0ubuntu0.24.04.12

8.3.6-0ubuntu0.24.04.12

ubuntu/php8.5<8.5.9-0ubuntu2

8.5.9-0ubuntu2

ubuntu/php8.5<8.5.4-0ubuntu1.4

8.5.4-0ubuntu1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/php7.0 to a version that resolves this vulnerability.
Fixed in 7.0.33-0ubuntu0.16.04.16+esm21
Upgrade
Upgrade ubuntu/php7.2 to a version that resolves this vulnerability.
Fixed in 7.2.24-0ubuntu0.18.04.17+esm13
Upgrade
Upgrade ubuntu/php7.4 to a version that resolves this vulnerability.
Fixed in 7.4.3-4ubuntu2.29+esm4
Upgrade
Upgrade ubuntu/php8.1 to a version that resolves this vulnerability.
Fixed in 8.1.2-1ubuntu2.27
Upgrade
Upgrade ubuntu/php8.3 to a version that resolves this vulnerability.
Fixed in 8.3.6-0ubuntu0.24.04.12
Upgrade
Upgrade ubuntu/php8.5 to a version that resolves this vulnerability.
Fixed in 8.5.9-0ubuntu2
Upgrade
Upgrade ubuntu/php8.5 to a version that resolves this vulnerability.
Fixed in 8.5.4-0ubuntu1.4

Event History

Sep 25, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which PHP clients are exposed to this issue?

Any affected PHP client that uses a default TLS stream is exposed, because peer-name verification is enabled by default. The listed Ubuntu PHP packages are php7.0, php7.2, php7.4, php8.1, php8.3, and php8.5.

What must an attacker control to trigger the flaw?

An attacker must operate or impersonate a TLS server contacted by the PHP client and present a certificate containing a wildcard name whose literal characters are longer than the hostname being verified. No authentication or user interaction is required.

What is the impact if exploitation succeeds?

The PHP client can read beyond the end of a heap allocation, potentially reading up to SIZE_MAX bytes past it. The reported impact is high confidentiality impact, with no reported integrity or availability impact.

UBUNTU-CVE-2026-91767: Medium severity ubuntu/php7.0 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which PHP clients are exposed to this issue?

What must an attacker control to trigger the flaw?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which PHP clients are exposed to this issue?

What must an attacker control to trigger the flaw?

What is the impact if exploitation succeeds?