CVE-2026-91769

TLS hostname verification falls back to CN after SAN mismatch

Publication Date 2026-09-25
Severity Moderate
Type Cross-Site Request Forgery
Affected PHP Versions
  • 7.2.0-7.2.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.33
  • 8.3.0-8.3.34
  • 8.4.0-8.4.25
  • 8.5.0-8.5.10
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.8

CVE Details

The vulnerability lies in PHP’s OpenSSL stream peer verification routine, which first checks the certificate’s subjectAltName entries and, when none match, falls back to using the Common Name (CN). RFC?6125 states that the CN must be ignored once any service identity is present, so a certificate that contains a non?matching DNS SAN but a matching CN is still accepted, allowing a trusted certificate for one name to be used to impersonate another.

Recommendations

Consider using cURL instead of the HTTP stream wrapper to perform HTTP requests. If you cannot, we recommend updating to a patched PHP version.