CVE-2026-91767
6.5 MEDIUMpublic exploit availablePublished 2026-09-25 · Updated 2026-09-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-122
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2016-15059PoC
- CRITICALCVE-2017-20241
- LOWCVE-2025-1218PoC
- CRITICALCVE-2026-102331
- HIGHCVE-2026-10575
- HIGHCVE-2026-10744
- CRITICALCVE-2026-10747
- CRITICALCVE-2026-10858
Related by shared AI tags and CWE weakness class. Browse the full archive.