CVE-2026-91769

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security (TLS) connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name (CN) if no Subject Alternative Name (SAN) matches the requested hostname. An attacker could exploit this flaw by presenting a certificate trusted for another domain whose CN matches the target, enabling them to impersonate a legitimate server and intercept sensitive data.

This vulnerability is evaluated as Moderate impact because an attacker must achieve an active man-in-the-middle network position and present a trusted certificate possessing a matching Common Name alongside disparate Subject Alternative Names. Exposure in Red Hat environments is restricted to outbound TLS client connections established via PHP streams; inbound application traffic processed by PHP-FPM or mod_php is unaffected. Furthermore, public certificate authorities generally disallow conflicting identity combinations, limiting the real-world attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.