IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
4.3Media

CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP Group PHP Publicada: (hace 1 mes)

Descripción

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

Debilidad (CWE): CWE-297

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
PHP Group PHP 8.2.* – < 8.2.34, 8.3.* – < 8.3.35, 8.4.* – < 8.4.26, 8.5.* – < 8.5.11

Referencias y parches

Coincidencias CPE (NVD) (4)
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.34
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.35
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.26
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.11

CVE recientes del mismo producto — PHP

9.2Crítica
CVE-2026-109619 KEV

RCE via stale global state

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS
9.2Crítica
CVE-2026-109618 KEV

RCE via OOM corruption

PHP Group PHP; Siemens AMIS TS; Siemens AX4; Siemens blueplanet 360 NX3 M6 WM OD IISX

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS
3.4Baja
CVE-2025-1218

Various packet overreads in mysqlnd_writeprotocol.c

PHP Group PHP

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buff…