CVE-2026-91769
Publication date 25 September 2026
Last updated 7 October 2026
Ubuntu priority
Description
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| php5 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 14.04 LTS trusty |
Vulnerable
|
|
| php7.0 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 16.04 LTS xenial |
Vulnerable
|
|
| php7.2 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Vulnerable
|
|
| php7.4 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Vulnerable
|
|
| php8.1 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Vulnerable
|
|
| php8.3 | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy | Not in release | |
| php8.5 | 26.04 LTS resolute |
Vulnerable
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Notes
sbeattie
PEAR issues should go against php-pear as of xenial PEAR issues should go against php-pear as of xenial
Severity score breakdown
CVSS version: CVSS v3.0
Base score
4.3 · Medium
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N