CVE-2026-91769

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91769", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2026-09-15T00:44:10.816Z", "datePublished": "2026-09-25T20:59:39.727Z", "dateUpdated": "2026-10-04T16:10:05.639Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-10-04T16:10:05.639Z"}, "title": "TLS Hostname Verification Falls Back to CN After SAN Mismatch", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-297", "description": "CWE-297 Improper validation of certificate with host mismatch", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "packageName": "ext-openssl", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested <code>peer_name</code>. A certificate trusted by the client for one name can therefore be used to impersonate another.</p>"}]}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Cantina (https://www.cantina.security/)", "type": "reporter"}, {"lang": "en", "value": "David Korczynski", "type": "reporter"}, {"lang": "en", "value": "Jakub Zelenka", "type": "remediation developer"}, {"lang": "en", "value": "Arnaud Le Blanc", "type": "remediation reviewer"}, {"lang": "en", "value": "Alexandre Daubois", "type": "remediation reviewer"}, {"lang": "en", "value": "@benzdeus (GitHub)", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-91769", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T12:56:47.310384Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T13:31:31.508Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-91769", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T12:56:47.310384Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T13:24:43.572Z"}}], "cna": {"title": "TLS Hostname Verification Falls Back to CN After SAN Mismatch", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Cantina (https://www.cantina.security/)"}, {"lang": "en", "type": "reporter", "value": "David Korczynski"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Zelenka"}, {"lang": "en", "type": "remediation reviewer", "value": "Arnaud Le Blanc"}, {"lang": "en", "type": "remediation reviewer", "value": "Alexandre Daubois"}, {"lang": "en", "type": "reporter", "value": "@benzdeus (GitHub)"}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PHP Group", "product": "PHP", "versions": [{"status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver"}, {"status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver"}, {"status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver"}], "packageName": "ext-openssl", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.", "supportingMedia": [{"type": "text/html", "value": "<p>PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested <code>peer_name</code>. A certificate trusted by the client for one name can therefore be used to impersonate another.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-297", "description": "CWE-297 Improper validation of certificate with host mismatch"}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2026-10-04T16:10:05.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-91769", "state": "PUBLISHED", "dateUpdated": "2026-10-04T16:10:05.639Z", "dateReserved": "2026-09-15T00:44:10.816Z", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "datePublished": "2026-09-25T20:59:39.727Z", "assignerShortName": "php"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "ext-openssl", "product": "PHP", "vendor": "PHP Group", "versions": [{"lessThan": "8.2.34", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.35", "status": "affected", "version": "8.3.*", "versionType": "semver"}, {"lessThan": "8.4.26", "status": "affected", "version": "8.4.*", "versionType": "semver"}, {"lessThan": "8.5.11", "status": "affected", "version": "8.5.*", "versionType": "semver"}]}], "source": "security@php.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "AAFB3643-4D71-46ED-8184-DDE5FE41CD02", "versionEndExcluding": "8.2.34", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF664EE8-D417-45A4-84DF-158F5073FDE8", "versionEndExcluding": "8.3.35", "versionStartIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "52D4BECA-EF0D-4180-837C-AEFA7A12D243", "versionEndExcluding": "8.4.26", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "308803C0-9FC8-40D2-8920-B83BCC48014F", "versionEndExcluding": "8.5.11", "versionStartIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}], "id": "CVE-2026-91769", "lastModified": "2026-10-23T13:20:43.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@php.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91769", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T12:56:47.310384Z", "version": "2.0.3"}}]}, "published": "2026-09-25T21:17:24.913", "references": [{"source": "security@php.net", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-297"}], "source": "security@php.net", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:70720", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "php-main-8.5.11-2.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "php: php: Server impersonation via Common Name fallback in TLS verification", "id": "2542493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542493"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-295", "details": ["PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.", "A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security (TLS) connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name (CN) if no Subject Alternative Name (SAN) matches the requested hostname. An attacker could exploit this flaw by presenting a certificate trusted for another domain whose CN matches the target, enabling them to impersonate a legitimate server and intercept sensitive data."], "name": "CVE-2026-91769", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "php8.4", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:7.4/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.3/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "php:8.4/php", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-25T20:59:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91769\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91769\nhttps://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.4.0,8.4.26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.5.0,8.5.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PHP", "source": "cna", "vendor": "PHP Group"}, "product": "php", "vendor": "php_group"}], "created": "2026-09-25T23:00:15.624767+00:00", "updated": "2026-09-30T05:30:18.345888+00:00", "vendors": ["php_group", "php_group$PRODUCT$php"]}