CVE-2026-91767: PHP OpenSSL Buffer Overflow Vulnerability

CVE-2026-91767 Overview

CVE-2026-91767 is a heap-based buffer over-read [CWE-122] in PHP's OpenSSL stream wrapper. The flaw lives in php_openssl_matches_wildcard_name() inside ext/openssl/xp_ssl.c. The function underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters exceed the length of the hostname being verified. A malicious TLS server can trigger the PHP client to read up to SIZE_MAX bytes past the end of a heap allocation. The code path is reachable from any default client stream because verify_peer_name is enabled by default.

Critical Impact
Any PHP application making outbound TLS connections to attacker-controlled or compromised servers can be forced into an out-of-bounds heap read, risking process crash and potential memory disclosure.

Affected Products

PHP (ext/openssl stream wrapper)
PHP applications performing outbound TLS connections with default stream settings
Any client code relying on php_openssl_matches_wildcard_name() for certificate hostname verification

Discovery Timeline

2026-09-25 - CVE-2026-91767 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-91767

Vulnerability Analysis

The vulnerability is a heap buffer over-read in PHP's TLS certificate hostname verification routine. During wildcard matching, the function computes the remaining hostname length after locating the leftmost label. When the wildcard pattern's literal characters are longer than the hostname being verified, this subtraction underflows into a very large size_t value. That value is then passed to memchr(), which scans memory far beyond the intended heap buffer boundary.

Because PHP streams enable verify_peer_name by default, the vulnerable path executes automatically on every HTTPS, FTPS, SMTPS, or other TLS client connection. An attacker who controls or impersonates a remote server can serve a crafted certificate to any PHP client that connects. Successful exploitation can crash the PHP process (denial of availability for the affected request) or, in combination with other primitives, aid in reading adjacent heap memory.

Root Cause

The root cause is an unchecked length calculation inside php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c. The function subtracts the length of the wildcard pattern's literal prefix and suffix from the hostname length without verifying the hostname is long enough. When the result underflows, the oversized size_t is handed to memchr(), producing an out-of-bounds read on a heap allocation.

Attack Vector

Exploitation requires the victim PHP application to initiate a TLS connection to an attacker-controlled endpoint, or for an on-path attacker to intercept and respond to a legitimate TLS handshake. The attacker presents an X.509 certificate containing a wildcard Subject Alternative Name whose literal characters are collectively longer than the client's requested hostname. The vulnerability is reachable with default stream context settings, so no misconfiguration on the client side is required.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-xr7j-rvgx-xq5p for upstream technical details.

Detection Methods for CVE-2026-91767

Indicators of Compromise

Unexpected PHP process crashes or segmentation faults correlated with outbound TLS client activity.
TLS handshakes from PHP clients to untrusted hosts returning certificates with wildcard SAN entries longer than the requested hostname.
Error log entries from ext/openssl referencing peer name verification failures immediately before a crash.

Detection Strategies

Inventory PHP installations and compare runtime versions against the fixed releases listed in the upstream advisory.
Inspect TLS traffic from PHP services for server certificates presenting unusually long wildcard patterns in the SAN field.
Correlate PHP-FPM or CLI crash dumps with the preceding outbound TLS destination to identify suspicious servers.

Monitoring Recommendations

Enable core dump collection on PHP workers and alert on repeated crashes in php_openssl_matches_wildcard_name.
Log all outbound TLS destinations from PHP application servers and baseline expected endpoints.
Monitor egress TLS flows for connections to newly observed or low-reputation domains, especially those serving certificates with wildcard names.

How to Mitigate CVE-2026-91767

Immediate Actions Required

Apply the patched PHP release referenced in the GitHub Security Advisory GHSA-xr7j-rvgx-xq5p as soon as it is available for your distribution.
Audit application code for outbound TLS calls using file_get_contents(), fopen(), curl with the PHP stream backend, or stream_socket_client() and restrict destinations to trusted hosts.
Restrict egress network access from PHP application servers to a known allowlist of endpoints.

Patch Information

The fix is tracked in the upstream php-src repository under advisory GHSA-xr7j-rvgx-xq5p. Consult the PHP Security Advisory for the specific patched versions and commit references, then upgrade to the corresponding packaged release provided by your Linux distribution or PHP vendor.

Workarounds

Where upgrade is not immediately possible, restrict PHP applications to connect only to a vetted allowlist of TLS endpoints via firewall or proxy policy.
For specific sensitive clients, disable verify_peer_name only in combination with pinning the server certificate through peer_fingerprint, so hostname matching is not required.
Route all outbound HTTPS traffic through a forward proxy that terminates TLS and re-presents certificates issued by a trusted internal CA.

bash

# Example stream context pinning the expected server certificate fingerprint
# instead of relying on wildcard hostname matching
$ctx = stream_context_create([
    'ssl' => [
        'verify_peer'      => true,
        'verify_peer_name' => false,
        'peer_fingerprint' => ['sha256' => 'EXPECTED_SHA256_FINGERPRINT_HEX'],
        'cafile'           => '/etc/ssl/certs/ca-certificates.crt',
    ],
]);