CVE-2026-91769CWE-297

CVE-2026-91769

Medium · published September 26, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00135 · 2.7th percentile
Weakness
CWE-297 · Improper Validation of Certificate with Host Mismatch
Published
2026-09-26T01:17Z
Affected products (4)
ProductVersionsFixed in
php/php≥ 8.2.0, < 8.2.348.2.34
php/php≥ 8.3.0, < 8.3.358.3.35
php/php≥ 8.4.0, < 8.4.268.4.26
php/php≥ 8.5.0, < 8.5.118.5.11
References (1)
https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx · [email protected]
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 20:59Z
    TLS Hostname Verification Falls Back to CN After SAN Mismatch
    cvelistv5