CVE-2026-91767

A flaw was found in PHP. When validating secure connections using Transport Layer Security (TLS), an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue against a connecting PHP client. This flaw primarily leads to information disclosure, potentially exposing sensitive data stored in application memory.

This vulnerability is rated Moderate because a PHP TLS client that verifies peer names can suffer an out-of-bounds read when a server presents a crafted wildcard certificate, crashing the client process (denial of service). The GHSA analysis indicates the scan result is used only for accept/reject and is not returned to the attacker, so Red Hat scores availability impact without confidentiality impact. Exploitation requires the client to connect to a server that can present such a certificate (malicious server or compromised/trusted CA path).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict outbound TLS connections from PHP applications to trusted servers and certificate authorities. Do not disable verify_peer_name as a workaround except after an explicit risk review.