CVE-2026-91769
mediumPHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name.
Vendor / product: Php — php
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
CVSS
4.3
4.3 (CVSS v3.1)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (security@php.net)
Timeline (UTC)
Published: 2026-09-25 21:17
Modified: 2026-10-23 13:20
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
php / php ≥8.2.0 <8.2.34, ≥8.3.0 <8.3.35, ≥8.4.0 <8.4.26, ≥8.5.0 <8.5.11
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗