Description
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Published: 2026-09-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Impersonation of TLS connections via certificate mis‑verification
Action: Update PHP
AI Analysis

Impact

The vulnerability lies in PHP’s OpenSSL stream peer verification routine, which first checks the certificate’s subjectAltName entries and, when none match, falls back to using the Common Name (CN). RFC 6125 states that the CN must be ignored once any service identity is present, so a certificate that contains a non‑matching DNS SAN but a matching CN is still accepted, allowing a trusted certificate for one name to be used to impersonate another.

Affected Systems

Any PHP installation that relies on OpenSSL for stream peer verification is affected. The CVE does not list specific PHP versions or patches; it applies to all affected releases until a patch is applied.

Risk and Exploitability

This flaw gives an attacker the ability to present a certificate that will be accepted for a TLS host that it did not originally cover, effectively enabling impersonation of the target server. The CVSS score of 4.3 indicates low overall severity, and the EPSS score is still very low (<1%). While this vulnerability is not listed in the CISA KEV catalog, it could be leveraged in targeted attacks that require a valid client‑trusted certificate.

Generated by OpenCVE AI on September 30, 2026 at 05:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Set up a workflow that automatically updates PHP to the most recent stable release that contains the fix for this SSL host‑name verification issue.
  • Verify that the updated PHP build is compiled against an OpenSSL version that enforces strict CN ignore when SANs are present.
  • If immediate update is not possible, configure your TLS endpoints to require that all certificates contain matching SAN entries for the intended hostnames, thereby preventing the CN fallback from being utilized.

Generated by OpenCVE AI on September 30, 2026 at 05:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4819-1 php8.2 security update
Debian DSA Debian DSA DSA-6514-1 php8.4 security update
Ubuntu USN Ubuntu USN USN-8936-1 PHP vulnerabilities
History

Fri, 23 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Php
Php php
CPEs cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Vendors & Products Php
Php php

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-295
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 28 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Php Group
Php Group php
Vendors & Products Php Group
Php Group php

Fri, 25 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Title TLS Hostname Verification Falls Back to CN After SAN Mismatch
Weaknesses CWE-297
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Php Php
Php Group Php
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: php

Published:

Updated: 2026-10-04T16:10:05.639Z

Reserved: 2026-09-15T00:44:10.816Z

Link: CVE-2026-91769

cve-icon Vulnrichment

Updated: 2026-09-28T13:24:43.572Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T21:17:24.913

Modified: 2026-10-23T13:20:43.460

Link: CVE-2026-91769

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-25T20:59:39Z

Links: CVE-2026-91769 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T05:30:18Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-297

    Improper Validation of Certificate with Host Mismatch