CVE-2026-91767

Name of the Vulnerable Software and Affected Versions PHP (affected versions not specified)

Description The function php openssl matches wildcard name() in ext/openssl/xp ssl.c contains an integer underflow in the length argument passed to memchr(). This occurs when a TLS server certificate uses a wildcard name with literal characters that exceed the length of the hostname being verified. A malicious server can exploit this to force the PHP client to read up to SIZE MAX bytes beyond a heap allocation. This issue is reachable via any default client stream as verify peer name is enabled by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.