# CVE-2026-91767: PHP OpenSSL heap-buffer overflow in wildcard certificate name matching

Source: https://junglewise.ai/threats/cve-2026-91767-php-openssl-matches-wildcard-name-in-ext-openssl-xp-ssl-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91767 · Severity: medium · CVSS 6.5 · Published 2026-09-25

PHP's TLS certificate verification contains a memory safety bug in wildcard hostname matching. A malicious TLS server can send a specially crafted certificate that causes a PHP client to read far beyond allocated memory, crashing the application and causing denial of service. This affects all PHP applications that connect to HTTPS or TLS servers using default settings.

Technologies: [Php](https://junglewise.ai/threats/technologies/php-php). Vendors: [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2026-91767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91767 being exploited in the wild.

**How severe is CVE-2026-91767?** Medium severity, with a CVSS score of 6.5, published 25 September 2026.

**Which products and versions are affected?** Php before 8.2.34, before 8.3.35, before 8.4.26, before 8.5.11.

**Is there a fix for CVE-2026-91767?** A patch was published on 2026-09-24: Patches released for versions 8.2.34, 8.3.35, 8.4.26, 8.5.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91767 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-91767?** Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The php_openssl_matches_wildcard_name() function in ext/openssl/xp_ssl.c contains an integer underflow when calculating the length argument to memchr(). When a wildcard certificate name's literal characters are longer than the hostname being verified, the length wraps to SIZE_MAX, causing an unbounded out-of-bounds read. The vulnerability is reachable from default client streams with verify_peer_name enabled, including file_get_contents(), fopen(), and stream_socket_client() on https:// and tls:// URLs. A patch changes prefix_len to size_t and adds proper bounds checking to prevent the underflow.

## Affected products

- PHP PHP before 8.2.34, before 8.3.35, before 8.4.26, before 8.5.11

## Timeline

- 2026-09-25: disclosed
- 2026-09-24: patched: Patches released for versions 8.2.34, 8.3.35, 8.4.26, 8.5.11

## References

- [https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p](https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p)

## Related threats

- [PHP stream filter heap information leak with NUL bytes in line-break-chars](https://junglewise.ai/threats/cve-2026-92842-the-convert-base64-encode-convert-quoted-printable-encode-and)
- [PHP OpenSSL stream peer verification certificate validation bypass](https://junglewise.ai/threats/cve-2026-91769-php-s-openssl-stream-peer-verification-checks-the-certificate-s)
- [PHP HTTP stream wrapper credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-91766-when-the-http-stream-wrapper-follows-a-redirect-it-forwards-the)
- [PHP SOAP XML parser unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-91765-cleanup-xml-node-in-the-soap-xml-parser-recurses-once-per-xml)
- [PHP Phar TAR integer overflow in size parsing](https://junglewise.ai/threats/cve-2026-6103-phar-tar-number-parses-the-octal-size-field-of-a-tar-header-into-a)