CVE-2026-91767

Information disclosure via crafted TLS server certificate

Publication Date	2026-09-25
Severity	Moderate
Type	Information Disclosure
Affected PHP Versions	7.2.0-7.2.34 7.3.0-7.3.33 7.4.0-7.4.33 8.1.0-8.1.34 8.2.0-8.2.33 8.3.0-8.3.34 8.4.0-8.4.25 8.5.0-8.5.10
Fixed Product Versions	ZendPHP 7.2 ZendPHP 7.3 ZendPHP 7.4 ZendPHP 8.1 ZendPHP 8.2 ZendPHP 8.3 ZendPHP 8.4 ZendPHP 8.5 ZendServer 2021.4.8

CVE Details

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default. A malicious server presenting a specially crafted certificate can exploit this issue against a connecting PHP client. This flaw primarily leads to information disclosure, potentially exposing sensitive data stored in application memory.

Recommendations

Consider using cURL instead of the HTTP stream wrapper when making web requests via PHP. If you cannot, consider disabling the verify_peer_name setting in the stream context:

$context = stream_context_create([
    'ssl' => [
        'verify_peer_name' => false,
    ],
    'http' => [
        'follow_location' => 0,
    ],
]);

$body = file_get_contents($url, false, $context);

We recommend updating to a patched version of PHP if you use the HTTP stream wrapper to make requests to servers using TLS.

---