CVE-2026-91767: 
PHP vulnerability analysis and mitigation

CVE-2026-91767 is a heap-based buffer overflow vulnerability in PHP's OpenSSL extension (php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c) that allows a malicious TLS server to trigger an out-of-bounds heap read during wildcard certificate hostname verification. It affects PHP versions before 8.2.34, 8.3.35, 8.4.26, and 8.5.11. The vulnerability was published on September 24, 2026, by Jakub Zelenka (bukka) and is tracked as GHSA-xr7j-rvgx-xq5p. It carries a CVSS v3.1 score of 6.5 (Moderate) (GitHub Advisory, PHP NEWS).

The root cause is an integer underflow (CWE-122: Heap-based Buffer Overflow) in the length calculation passed to memchr() within php_openssl_matches_wildcard_name(). The third argument to memchr() is computed as subject_len - suffix_len - prefix_len, where subject_len and suffix_len are size_t but prefix_len is ptrdiff_t; arithmetic promotion converts the entire expression to size_t, causing wraparound to SIZE_MAX when prefix_len + suffix_len > subject_len. For example, verifying a wildcard CN of aaa*aa against the hostname aaaa yields (size_t)(4 - 2 - 3), which wraps to SIZE_MAX, causing memchr() to scan up to SIZE_MAX bytes past the end of the heap allocation. The fix changes prefix_len to size_t and adds the guard suffix_len + prefix_len <= subject_len before the subtraction. The code path is reachable from any default PHP TLS client stream (file_get_contents(), fopen(), stream_socket_client() on https:// or tls://) because verify_peer_name is enabled by default. A public proof-of-concept is included in the advisory (GitHub Advisory).

A malicious TLS server (or a server whose CA is trusted by the PHP client) can cause the PHP process to perform an unbounded out-of-bounds heap read during TLS hostname verification, resulting in a process crash and denial of service. The scan stops at the first . byte encountered, and the result only feeds the accept/reject decision, so heap content is not returned to the attacker — confidentiality impact is therefore limited to potential information disclosure via crash analysis rather than direct data exfiltration. Availability is the primary concern, as the process crash affects any PHP application making outbound TLS connections to attacker-controlled or compromised servers (GitHub Advisory).

A public proof-of-concept is included in the official GitHub Security Advisory, demonstrating exploitation using a crafted CA and server certificate with a wildcard CN longer than the target hostname. No evidence of in-the-wild exploitation has been reported, and the CVE remains in "Reserved" status with limited public database entries. The attacker must control or compromise the TLS server the PHP client connects to, or be in a position to present a trusted crafted certificate, which limits opportunistic exploitation. No EPSS score or CISA KEV catalog entry has been identified for this CVE. Nessus detection plugins (IDs 349693, 349787, 349788) have been published (GitHub Advisory, Feedly).

1. Set up a malicious CA: Generate a self-signed CA certificate that will be trusted by the target PHP client (e.g., by placing it in the cafile context option or the system trust store).

   openssl req -x509 -newkey rsa:2048 -keyout ca.key -out ca.crt -days 30 -nodes -subj "/CN=poc-ca"

2. Craft a malicious server certificate: Create a server certificate with a wildcard CN whose literal characters (prefix + suffix) are longer than the hostname to be verified (e.g., CN=aaa*aa against hostname aaaa).

   openssl req -newkey rsa:2048 -keyout server.key -out server.csr -nodes -subj "/CN=aaa*aa"
   openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 30

3. Host a TLS server: Serve the crafted certificate from a local or remote TLS listener (e.g., using openssl s_server or a custom server on port 443/18443).
4. Trigger the vulnerable PHP client: Cause the target PHP application to make an outbound HTTPS/TLS connection to the attacker's server with verify_peer_name enabled (the default). This can be via file_get_contents(), fopen(), or stream_socket_client() targeting the attacker's host.
5. Achieve denial of service: The underflow in php_openssl_matches_wildcard_name() causes memchr() to scan past the heap allocation boundary. In production builds, the process continues scanning until it hits an unmapped page and crashes, resulting in denial of service (GitHub Advisory).

• Process: PHP process (CLI, FPM worker, or web SAPI) crashes with a segmentation fault or bus error during an outbound TLS connection; crash dumps referencing php_openssl_matches_wildcard_name, php_openssl_matches_common_name, or php_openssl_apply_peer_verification_policy in the stack trace.
• Logs: PHP error logs or FPM logs showing fatal errors or segfaults during HTTPS requests to external hosts; ASAN output showing heap-buffer-overflow READ in ext/openssl/xp_ssl.c:438 (in debug/sanitizer builds).
• Network: Outbound TLS connections to servers presenting certificates with wildcard CNs where the literal prefix plus suffix length exceeds the length of the hostname being verified; unexpected TLS handshake failures followed by process termination.
• File System: Core dump files generated by PHP process crashes in the working directory or system core dump location (GitHub Advisory).

Upgrade PHP to the patched versions: 8.2.34, 8.3.35, 8.4.26, or 8.5.11, which include the fix for CVE-2026-91767 in the OpenSSL extension. As a temporary workaround, applications can explicitly set verify_peer_name => false in TLS stream contexts, though this weakens TLS security and is not recommended for production. Alternatively, restrict outbound TLS connections to trusted, controlled servers until patching is feasible. The fix was authored by Jakub Zelenka and is included in the PHP 8.4.26 and 8.5.11 releases dated September 24, 2026 (PHP NEWS, GitHub Advisory).

The vulnerability was covered by SecurityOnline.info as part of a broader PHP security patch roundup, and Remi's RPM repository published patched builds for RHEL and Fedora shortly after the release. Nessus detection plugins were published by Tenable within days of disclosure. No notable individual researcher commentary or significant social media discussion beyond standard patch announcements has been identified (SecurityOnline, Remi's Blog).