Vulnerability in PHP Group PHP

[ Description ]Official description

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3585

  PHP: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-92842CVE-2026-91765CVE-2026-93682+7 more CVEs
• CERT-FR24 Sep 2026CERTFR-2026-AVI-1227

  Multiple vulnerabilities in PHP Translated from French

  Multiple vulnerabilities have been discovered in PHP. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2025-14181CVE-2026-91765CVE-2026-92842+8 more CVEs

[ References ]References

• github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p