CVE-2026-91767 PHP Group CVE debrief

Who should care

Defenders responsible for PHP installations, TLS server configurations, and network security should be aware of this vulnerability and take steps to verify and update their systems.

Why it matters

CVE-2026-91767 is a vulnerability in PHP's openssl extension that allows a malicious TLS server to cause a heap buffer overflow. Defenders should prioritize verifying and updating PHP installations, reviewing TLS server configurations, and monitoring client connections to prevent potential security incidents.

• Potential heap buffer overflows when connecting to TLS servers with specially crafted certificates.
• Possible denial of service (DoS) or remote code execution (RCE) attacks.
• Need for verification and updates to PHP installations to prevent exploitation.
• Importance of monitoring PHP client connections for potential security incidents.

Technical summary

The php_openssl_matches_wildcard_name() function in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. This allows a malicious server to make the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The vulnerability affects PHP's openssl extension, impacting defenders who need to verify and update their PHP installations to prevent potential heap buffer overflows.

Defensive priority

Defenders should prioritize verifying and updating PHP installations to prevent potential heap buffer overflows when connecting to TLS servers with specially crafted certificates.

Recommended defensive actions

• Verify and update PHP installations to ensure the latest security patches are applied.
• Review and update TLS server configurations to prevent the presentation of malicious certificates.
• Monitor PHP client connections for potential heap buffer overflows.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in PHP's openssl extension. Additional information from other sources may be necessary to fully assess the impact and develop effective mitigations. Defenders should verify PHP installations, review TLS server configurations, and monitor client connections. Evidence limits suggest focusing on CVE and NVD details for now.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.