Vulnerability · Published Sep 25, 2026 · Assigned by php
CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch
Medium 4.3
In plain English
A medium-severity security flaw in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | php | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-bcmath | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-cli | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-common | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-dba | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-dbg | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-devel | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-embedded | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-enchant | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-ffi | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-fpm | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-gd | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-gmp | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-intl | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-json | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-ldap | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-mbstring | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-mysqlnd | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-odbc | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-opcache | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pdo | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pear | 1:1.10.13-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pgsql | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-process | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-snmp | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-soap | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-xml | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-xmlrpc | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| Alpine:v3.22 | php82 | 8.2.35-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.22 | php83 | 8.3.36-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.23 | php83 | 8.3.36-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.24 | php83 | 8.3.35-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.22 | php84 | 8.4.27-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.23 | php84 | 8.4.27-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.24 | php84 | 8.4.26-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.23 | php85 | 8.5.12-r0 | ALPINE-CVE-2026-91769 |
| Alpine:v3.24 | php85 | 8.5.11-r0 | ALPINE-CVE-2026-91769 |
| Debian:12 | php8.2 | 8.2.34-1~deb12u1 | DEBIAN-CVE-2026-91769 |
| Debian:13 | php8.4 | 8.4.26-1~deb13u1 | DEBIAN-CVE-2026-91769 |
| Debian:14 | php8.4 | 8.4.26-1 | DEBIAN-CVE-2026-91769 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.10.0+1912+72767185 | RLSA-2026:87080 |
| Rocky Linux:8 | php | 0:7.4.33-8.module+el8.10.0+40393+c071e357 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.10.0+1605+02e07af7 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.10.0+1912+72767185 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pear | 1:1.10.13-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.10.0+1912+72767185 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.10.0+1912+72767185 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.10.0+1912+72767185 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.10.0+1912+72767185 | RLSA-2026:87080 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.27 | USN-8936-1 |
| Ubuntu:22.04:LTS | php8.1 | 8.1.2-1ubuntu2.27 | UBUNTU-CVE-2026-91769 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.12 | UBUNTU-CVE-2026-91769 |
| Ubuntu:24.04:LTS | php8.3 | 8.3.6-0ubuntu0.24.04.12 | USN-8936-1 |
| Ubuntu:26.04:LTS | php8.5 | 8.5.4-0ubuntu1.4 | UBUNTU-CVE-2026-91769 |
| Ubuntu:26.04:LTS | php8.5 | 8.5.4-0ubuntu1.4 | USN-8936-1 |
| Ubuntu:26.10 | php8.5 | 8.5.9-0ubuntu2 | UBUNTU-CVE-2026-91769 |
| Ubuntu:26.10 | php8.5 | 8.5.9-0ubuntu2 | USN-8936-1 |
Affected products (as reported)
Weakness: CWE-297 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N