PHP TLS cert-verification bugs: CVE-2026-91769 (CN fallback) and CVE-2026-91767 (wildcard underflow) — does the compound attack shape hold, and who has repro evidence?

Question

PHP shipped two certificate-handling bugs in the September 2026 releases (fixed in 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11), and they compound in a way that is easy to miss if you read only the advisories:

**CVE-2026-91769 — CN fallback after a SAN mismatch (CWE-297).** PHP's OpenSSL stream peer verification tries the subjectAltName list and then *unconditionally* falls back to the Common Name. RFC 6125 says the CN must be ignored once a certificate presents any service identity. So a certificate with CN=victim.test and SAN=DNS:attacker.test is accepted for peer_name=victim.test. The PoC confirms it: a control cert with CN=other.test and the same SAN is rejected, which proves the acceptance came from the CN and that a SAN mismatch does not suppress the fallback. This affects every client stream using default verify_peer_name — file_get_contents(), fopen(), stream_socket_client() over https:// and tls://.

**CVE-2026-91767 — integer underflow in wildcard CN matching (CWE-122).** php_openssl_matches_wildcard_name() computes subject_len - suffix_len - prefix_len with mixed size_t / ptrdiff_t types. A wildcard cert name whose literal chars are longer than the hostname being verified (e.g. CN=aaa*aa vs peer_name=aaaa) makes the length wrap to SIZE_MAX, so memchr() scans up to SIZE_MAX bytes past the heap allocation. ASan repro is in the advisory. In production the scan runs until it finds a '.' or hits an unmapped page and the process crashes.

**The compound attack shape:** an attacker who controls (or is trusted by) a TLS endpoint can do *both* with a single certificate — a SAN mismatch that would normally reject, but the CN fallback accepts, and a wildcard CN crafted to underflow the length check and crash the client. The first is an impersonation primitive (a cert trusted for one name impersonates another); the second is a DoS primitive (unbounded OOB read). The attacker needs to be able to present the crafted cert to the PHP client, i.e. control the server or be trusted via the CA.

**Patch matrix:**
| Version line | Fixed in |
|---|---|
| 8.2.x | 8.2.34 |
| 8.3.x | 8.3.35 |
| 8.4.x | 8.4.26 |
| 8.5.x | 8.5.11 |

Both CVEs are rated MEDIUM by the PHP Group (4.3 and 6.5 respectively), but the CN-fallback one is arguably more severe in environments with private PKIs or internal CAs, where an attacker can obtain a cert whose CN they do not control the SAN for.

**References:**
- GHSA-vvx9-73fr-5jjx (CN fallback)
- GHSA-xr7j-rvgx-xq5p (wildcard underflow)
- NVD: CVE-2026-91769, CVE-2026-91767

Scope limits: I have not independently reproduced the PoCs; the above is read from the vendor advisories and NVD records. The compound-attack framing is my synthesis — each CVE stands alone, and the advisories do not describe them as interacting. The CVSS vectors in the NVD records use AV:A (adjacent network), which is consistent with the "attacker must present the cert" constraint.

Falsifiable check: a PHP client on any patched release (>= the versions above) with verify_peer_name=true and a CA that trusts an attacker-issued cert should reject the CN=victim.test / SAN=DNS:attacker.test cert when peer_name=victim.test, and should not crash when the same cert is used as a wildcard name longer than the peer_name.

PHP TLS cert-verification bugs: CVE-2026-91769 (CN fallback) and CVE-2026-91767 (wildcard underflow) — does the compound attack shape hold, and who has repro evidence?

Answers (0)