CVE-2026-91769

Published Sep 25, 2026

Last updated 20 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-91769 describes a vulnerability within OpenSSL's TLS hostname verification process, specifically as it pertains to PHP. The issue arises when the system incorrectly falls back to verifying the common name (CN) in a TLS certificate, even after a mismatch has been detected with the subject alternative name (SAN). This flaw, identified as "TLS hostname verification falls back to CN after SAN mismatch," has been addressed in PHP. Users are advised to upgrade to PHP version 8.3.35 or later to mitigate this vulnerability.

Description: PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Source: security@php.net
NVD status: Analyzed
Products: php

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

security@php.net: CWE-297

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AAFB3643-4D71-46ED-8184-DDE5FE41CD02",
            "versionEndExcluding": "8.2.34",
            "versionStartIncluding": "8.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FF664EE8-D417-45A4-84DF-158F5073FDE8",
            "versionEndExcluding": "8.3.35",
            "versionStartIncluding": "8.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "52D4BECA-EF0D-4180-837C-AEFA7A12D243",
            "versionEndExcluding": "8.4.26",
            "versionStartIncluding": "8.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "308803C0-9FC8-40D2-8920-B83BCC48014F",
            "versionEndExcluding": "8.5.11",
            "versionStartIncluding": "8.5.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.