CVE-2026-12184

NULL pointer dereference in PHP: in ext/standard/httpfopenwrapper.c phpstreamurlwraphttpex, when phpstreamxportcryptosetup fails while enabling TLS the stream is reset to NULL but the peer-name reset code then dereferences it. A remote server that fails TLS setup expired cert, peer-name mismatch...