Improper Validation of Certificate with Host Mismatch Affecting php package, versions [,8.2.34)[8.3.0RC1,8.3.35)[8.4.0RC1,8.4.26)[8.5.0RC1,8.5.11)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-PHP-20158689
- published27 Sept 2026
- disclosed25 Sept 2026
- creditchristos-cantina-security,DavidKorczynski
Introduced: 25 Sep 2026
NewCVE-2026-91769 (opens in a new tab)How to fix?
Upgrade php to version 8.2.34, 8.3.35, 8.4.26, 8.5.11 or higher.
Overview
Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in php_openssl_apply_peer_verification_policy() in ext/openssl/xp_ssl.c, which falls back to matching the Common Name whenever the subjectAltName list contains no matching entry, although RFC 6125 requires the CN to be disregarded once any DNS SAN is present. An attacker can impersonate a host the client trusts and read or modify the traffic in a MitM position, by presenting a certificate whose SAN entries cover names they legitimately hold and whose CN names the target host. This requires network position between the client and the server, peer verification left at its default enabled state, and a certificate from a CA the client trusts whose CN can be set independently of the SAN entries, which points to private or internal PKI rather than public issuance.