Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143722 advisory. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125...

Ubuntu 24.04 LTS / 26.04 LTS : libgit2 vulnerability (USN-8907-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8907-1 advisory. It was discovered that libgit2 incorrectly handled IP address SubjectAltName verification in TLS certificate validation. A remote attacker with a...

BIT-THRIFT-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

CLEANSTART-2026-AU05968 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name

Security vulnerability affects the php package. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name...

USN-8907-1: libgit2 vulnerability

It was discovered that libgit2 incorrectly handled IP address SubjectAltName verification in TLS certificate validation. A remote attacker with a CA-trusted certificate could possibly use this issue to perform a machine-in-the-middle attack, leading to the exposure of sensitive information...

AZL-106548 CVE-2026-85088 affecting package thrift 0.24.0-1

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

CVE-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through PkixNameConstraintValidator.ExtractHostFromURL in crypto/src/pkix/PkixNameConstraintValidator.cs. An attacker can bypass URI name constraints during certification path validation by supplying a...

PT-2026-105118

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

PT-2026-105148

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

SUSE CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

DEBIAN-CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

UBUNTU-CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

EUVD-2026-87346

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91769

A flaw exists in PHP 's OpenSSL stream peer verification where the system improperly falls back to the Common Name (CN) if no Subject Alternative Name (SAN) matches the requested hostname. This violates RFC 6125 , as the CN should be ignored when service identities are present. An attacker could ...

PT-2026-98288

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description OpenSSL stream peer verification incorrectly handles certificate validation by falling back to the Common Name CN when no entries in the subjectAltName SAN match. According to RFC 6125, the CN...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openldap (UTSA-2026-090503)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090503 advisory. libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even wh...