NES for PHP 7 Release Notes: PHP 7.1

PHP 7.1

7.1.1 (NES) - November 5, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.1.33-nes-7.1.1/ (see Installation)

Based on PHP 7.1.33.

This release patches the following CVEs:

• CVE-2026-109618 An out-of-memory error (memory_limit), or an allocation or string-size overflow check, raised E_ERROR and jumped (bailed out) with longjmp() out of code that could have left request memory half-initialised, and the request shutdown then ran on that memory, which can corrupt the heap (rated as remote code execution). - (Critical)
• CVE-2026-109619 Global state that points into request memory (the user error and exception handlers, EG(error_handling) and EG(exception), PG(http_globals), the authentication and content-type pointers of the SAPI request information, the request variable arrays) was not always reset at the end of a request, so a later request in the same process could read or act on freed memory. - (Critical)
• CVE-2020-7071 FILTER_VALIDATE_URL accepted a URL whose userinfo held characters that RFC 3986 does not allow, so the host PHP saw could differ from the host a client later contacted (an SSRF filter bypass). - (Medium)
• CVE-2021-21702 SoapClient and SoapServer dereferenced a NULL element name while parsing a WSDL document that holds a node without a name, which crashes the process. - (Medium)
• CVE-2021-21705 FILTER_VALIDATE_URL checked the user part of the userinfo but not the password part, so a URL with a crafted password passed the filter while a client contacted another host (an SSRF bypass). - (Medium)
• CVE-2021-21704 pdo_firebird trusted sizes the Firebird server sends: firebird_info_cb() appended server text to a 512-byte stack buffer with strcat(), firebird_handle_doer() and firebird_stmt_execute() read a result buffer by a server-given size and length, and firebird_fetch_blob() added 1 to a BLOB length that can be the maximum value. - (Medium)
• CVE-2021-21703 php-fpm kept its scoreboard in shared memory as an array of pointers to per-process slots. - (High)
• CVE-2021-21707 The libxml-based functions that take a file name accept URIs with percent-encoding, and a percent-encoded NUL byte (%00) cut the path short like a raw NUL byte does, which defeats a check the application made on the name. - (Medium)
• CVE-2022-31625 pg_query_params() and pg_send_execute() freed the whole parameter array when a parameter could not be converted to a string, although only the entries converted so far were set, so uninitialised pointers were freed (rated as remote code execution upstream). - (High)
• CVE-2022-31626 mysqlnd sized the buffer for the authentication-switch response by the data length and not by the 4-byte packet header it writes ahead of the data, so a long password overflowed the heap buffer by up to 4 bytes. - (High)
• CVE-2022-31629 PHP mangles request variable names (a dot or a space becomes an underscore), so a cookie such as ..Host-name became __Host-name. - (Medium)
• CVE-2022-31628 The phar wrapper decompresses a gzip or bzip2 phar and then looks at the result, which can itself be compressed, and it looped without a limit: a gzip 'quine' that decompresses to itself keeps it busy for good (a denial of service). - (Low)
• CVE-2022-31631 PDO::quote() on a SQLite connection passed twice the string length plus 3 to sqlite3_snprintf() as an int, which overflows for a string of about 1 GiB or more, so the result could come back unquoted and open to SQL injection. - (Critical)
• CVE-2023-0567 PHP's copy of crypt_blowfish let a $ cut the 22-character bcrypt salt short and zero-filled the rest, so such a hash could verify any password with password_verify() or a comparison with crypt()'s result. - (High)
• CVE-2023-0568 Appending a slash to a path of the maximum length wrote one byte past a MAXPATHLEN buffer in the open_basedir check, in DOMDocument loading and in XMLReader::XML(), which can crash PHP. - (High)
• CVE-2023-0662 PHP parsed every part of a multipart/form-data body however many there were, so a request with a huge number of tiny parts cost far more CPU than its size suggests (a denial of service). - (High)
• CVE-2023-3247 SoapClient's HTTP Digest authentication built its client nonce from a 31-bit random number and did not check that the random source worked, so a failure sent uninitialised stack bytes; the small nonce also weakens the digest against a hostile server. - (Low)
• CVE-2023-3824 phar_dir_read() assumed the caller's buffer was a whole directory entry and wrote the entry name and a terminator without checking either against the buffer, so a long entry name or a smaller read overflowed it. - (Critical)
• CVE-2023-3823 libxml2 has process-wide parser defaults (such as entity substitution), and a third-party extension that sets them made PHP's XML parsers substitute entities, a way to external entity (XXE) attacks, although the script never asked for it. - (High)
• CVE-2024-2756 The __Host- and __Secure- prefix check of CVE-2022-31629 ran too early, before the later mangling rules, so a variable name that is mangled again could still end up with the prefix and pass for a cookie set securely. - (Medium)
• CVE-2024-3096 A bcrypt password that starts with a NUL byte was hashed as the empty string, so password_verify() accepted an empty password for that hash. - (Medium)
• CVE-2024-5458 FILTER_VALIDATE_URL returned success as soon as the host was a bracketed IPv6 address, which skipped the remaining checks, including the userinfo check, so a malformed URL with such a host passed the filter. - (Medium)
• CVE-2024-8925 A multipart boundary longer than the parser's read buffer was not matched reliably when it was split across two reads, so form data could be split or merged wrongly, which breaks the integrity of the request data. - (Low)
• CVE-2024-8927 With cgi.force_redirect on (the default) php-cgi refuses to run unless the web server set REDIRECT_STATUS or HTTP_REDIRECT_STATUS; a client can send a Redirect-Status request header, which a web server passes on as HTTP_REDIRECT_STATUS, and so reach scripts that the protection should have kept out. - (High)
• CVE-2024-11236 The quoters of pdo_dblib and pdo_firebird added up the quoted length without checking for overflow, so a very long string allocated a buffer that was too small and the quoting wrote past it. - (Critical)
• CVE-2024-11234 The HTTP stream wrapper put the URL path into the request line without checking it for CR and LF when the stream context sets request_fulluri (used with a proxy), so a URL could inject headers or a second request. - (Medium)
• CVE-2024-8932 ldap_escape() added up the escaped length without checking for overflow, so an input that makes the sum wrap allocated too small a buffer and wrote past it. - (Critical)
• CVE-2024-11233 The convert.quoted-printable-decode stream filter read one byte past the end of its input when the input ended while it was matching a soft line break. - (Medium)
• GHSA-4w77-75f9-2c8w The CLI built-in web server set the request's content type only when the request had a Content-Type header, so a request without one kept a stale pointer, and sapi_read_post_data() then used freed memory.
• CVE-2026-6722 SoapServer and SoapClient keep a map from XML nodes to decoded values while they decode a message. - (Critical)
• CVE-2026-7261 When the handling of a SOAP header failed or threw in a SoapServer that uses a class with SOAP_PERSISTENCE_SESSION, handle() freed the service object although the session still held it, and the next request used freed memory. - (Medium)
• CVE-2026-7262 The decoder for apache:Map items checked the key a second time where it meant to check the value, so an item without a <value> element dereferenced NULL instead of raising the intended error. - (Low)
• CVE-2026-7568 metaphone() indexed its input with int offsets, which overflow on an input of 2 GiB or more (a signed overflow of an offset into the buffer). - (Medium)
• CVE-2026-6735 The full, HTML output of the php-fpm status page printed each running request's URI without escaping it, and the flags it used for the query string left quotes unescaped, so a request with markup in its URI or query string ran script in the browser of whoever opened the page (cross-site scripting). - (High)
• CVE-2026-14355 openssl_encrypt() sized its output buffer for one extra block, but AES key wrap with padding (RFC 5649) can write one more, so the output overflowed the heap block. - (Medium)
• CVE-2026-9672 The bundled libgd's GIF decoder cleared one entry of its second code table instead of all of them, did not initialise its state, and went on after a clear code with a zero count, so a crafted GIF read uninitialised stack memory and could go out of bounds.
• CVE-2026-17543 pg_convert() and the functions built on it quoted a string as E'...' after PQescapeStringConn() had escaped it, but that function does not double a backslash when standard_conforming_strings is on, so a backslash let the value break out of the literal (SQL injection). - (High)
• CVE-2026-7260 A tar phar whose symlink entries point at each other made phar_get_link_source() recurse without end, which overflowed the stack and crashed the process. - (Medium)
• CVE-2026-91765 SoapServer and SoapClient walked XML recursively in several places (the clean-up of the document, the search for an attribute, the decoding of nested values and of href chains), so a deeply nested document, or href references that chain or loop, overflowed the stack. - (High)
• CVE-2025-1217 The HTTP stream wrapper read each response header line on its own, so a folded header (a continuation line that starts with a space or tab) was misread: the continuation became a header of its own and the folded value, for example the charset of a Content-Type, was lost, so an application could act on the wrong type, Location or other header. - (Medium)
• CVE-2025-1734 The HTTP stream wrapper accepted a response header line without a colon as a header with an empty value, and kept a header name with a space in it, so an application that reads $http_response_header could be misled by an invalid header. - (Medium)
• CVE-2025-1736 To decide whether the stream context's header option already holds a standard header (Authorization, Host, User-Agent, From, Content-Length, Content-Type or Connection), the HTTP stream wrapper looked for the name after any line break, space or tab, and at its first occurrence only. - (Medium)
• CVE-2025-1861 The HTTP stream wrapper kept a redirect's Location header in a 1024-byte buffer and built the new URL in 1024-byte stack buffers, so a longer Location was cut and the request followed a different URL than the server sent. - (Medium)
• CVE-2026-93682 When the HTTP stream wrapper followed a redirect whose Location header was empty, it read the byte after the string's terminator (a one-byte heap over-read) to decide whether to join a relative path to the request's path or to use the host root, so a byte that was not part of the header chose the target. - (Medium)
• CVE-2026-91766 The HTTP stream wrapper sent the header option of the stream context again on every redirect it followed, so credentials meant for one server (Authorization, Cookie, Proxy-Authorization) went to whatever host, port or scheme a redirect named, including an https to http downgrade. - (Medium)
• CVE-2025-1220 fsockopen() built host:port with a %s format, which stops at a NUL byte, and the socket transports parsed the host as a C string, so a host such as localhost\0.example.com connected to localhost while a check the application made on the whole string saw another host (an allow-list or SSRF check bypass). - (Low)
• GHSA-www2-q4fc-65wf The DNS and network lookup functions passed their string argument to the C resolver, which stops at a NUL byte, so php.net\0evil looked up php.net while a check the application made on the whole string saw another name (the same class as CVE-2025-1220).
• CVE-2025-6491 libxml2 older than 2.13 leaves a node without a name when xmlNodeSetName() gets a name longer than 2 GiB, and serialize_zval() then called strcmp() on the NULL name (a NULL dereference, which crashes the process). - (Medium)
• CVE-2025-14181 SoapClient's HTTP response reader added up the sizes of a chunked response in an int and guarded the growth with a check that relies on signed overflow, which a compiler may remove, so a server sending chunks that add up to a very large total could wrap the size and make the client write a chunk into a much smaller buffer (a heap buffer overflow). - (Medium)
• GHSA-wg4p-4hqh-c3g9 With XML_OPTION_SKIP_TAGSTART set to more than the length of a tag name, xml_parse_into_struct() passed tag_name + toffset, past the end of the name, to the code that builds the $index array, which read it as a string: an out-of-bounds heap read whose bytes can end up in the keys of $index.
• CVE-2024-8929 mysqlnd trusted lengths in the server's packets without checking them against the packet size: the default value of a column definition, the file name of a LOCAL INFILE request, the message of an OK packet, the values of a prepared statement's binary rows (integers, bits, floats, doubles, times, dates, datetimes and strings) and the row length of a text result (an overflow on 32-bit builds only). - (Medium)
• CVE-2025-1218 mysqlnd read length-encoded integers and strings from the server's greeting, OK, EOF, authentication switch, change-user, result set header, prepare response and row packets without checking that the packet still held them, and the prepared statement row decoder trusted a field length shorter than its type needs. - (Low)
• CVE-2025-1735 ext/pgsql and ext/pdo_pgsql called libpq's escaping functions without checking whether they failed. - (Medium)
• CVE-2017-9120 mysqli_real_escape_string() (and mysqli::real_escape_string()) allocated twice the input length with zend_string_alloc(2 * len), which wraps when the doubled length does not fit in size_t, so the escaped string is written past a buffer that is too small.
• CVE-2026-6103 phar_parse_tarfile() read an entry's 12-byte octal size into a uint32_t without checking it, so a size above 4 GiB (or a GNU base-256 size) wrapped, and it skipped the data blocks of regular files only, so the data of other entry types (and of a GNU long link record) was parsed as further tar headers. - (Medium)
• CVE-2026-91767 When PHP checks a TLS server's certificate name against a wildcard name, matches_wildcard_name() checked only that the part after the * fits in the peer name. - (Medium)
• CVE-2026-91769 With verify_peer_name on, PHP checked a certificate's subjectAltName entries and, when none matched, fell back to the Common Name, so a certificate whose SAN names other hosts but whose CN holds the expected name was accepted. - (Medium)
• CVE-2026-91768 fcgi_is_allowed(), shared by php-fpm and php-cgi, compared an IPv6 client address with each allowed address on 12 bytes instead of 16, so listen.allowed_clients (php-fpm) and FCGI_WEB_SERVER_ADDRS (php-cgi) matched a whole /96 prefix: any host whose address shared the first 96 bits with an allowed one could speak FastCGI to the pool and run scripts with parameters of its choosing. - (Medium)
• GHSA-ch8v-r6jh-4vvr FILTER_SANITIZE_ENCODED built its table of bytes to encode with memset(tmp, 1, sizeof(tmp) - 1), which left the entry for the byte 0xFF uninitialised, so whether 0xFF was percent-encoded depended on stack contents and a value that should have been encoded could pass through raw.
• CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters copied their line-break-chars option with pestrdup(), which stops at a NUL byte, but kept the original length, so a value with a NUL byte made the filter read past its copy and put the heap bytes it found into its output (an information leak). - (Medium)
• CVE-2026-7258 Many callers passed a plain, signed char to isdigit(), isalnum(), isspace(), tolower() and the other ctype.h functions, which take an int that must be EOF or an unsigned char value. - (Medium)
• CVE-2017-9118 preg_replace() and the other preg replace functions sized their result buffer with zend_safe_address_guarded() and then allocated a zend_string, whose header the guard did not count, so a result length just below SIZE_MAX wrapped and the buffer was too small for the copy that follows (an out-of-bounds write).
• CVE-2019-11045 The constructors of DirectoryIterator, FilesystemIterator, RecursiveDirectoryIterator and GlobIterator took a string and used it only up to its first NUL byte, so a path such as dir\0/sub listed dir and defeated a check the application made on the path. - (Low)
• CVE-2019-11046 bc_str2num(), the parser behind every bcmath function, tested digits with isdigit() on a plain char, which takes a negative value for bytes above 0x7f and accepts whatever the C library classes as a digit, so the digit count and the shift that follows could index before a buffer (a buffer underflow in bc_shift_addsub()). - (Low)
• CVE-2019-11047 The EXIF MakerNote parser compared the note's identifier string with strncmp() without checking that the note was long enough, so a short MakerNote read past the end of its buffer (a heap buffer over-read). - (Medium)
• CVE-2019-11050 The EXIF MakerNote parser passed each tag the length of the whole note instead of what is left after that entry's offset, so a crafted MakerNote made tag parsing read past the end of its buffer (reported as a use after free under MemorySanitizer). - (Medium)
• CVE-2019-11048 The multipart parser kept the length of an array-style field name and of a field value in an int, so a name or value of 2 GiB or more wrapped and the parser misallocated, which ended in an out-of-memory error and left the upload's temporary files behind. - (Medium)
• CVE-2020-7059 php_strip_tags_ex() looked at the previous byte (p - 1) without checking that it was inside the buffer, so some inputs made it read one byte before the start (an out-of-bounds read). - (Medium)
• CVE-2020-7060 The CP950 (Microsoft Big5) decoder's test for the private-use area accepted a wider range of second bytes than its table holds, so some byte pairs indexed outside the table (a global buffer over-read). - (Medium)
• CVE-2020-7062 At the end of an upload the session upload progress callback wrote to its progress data without checking that it had been set up, and dereferenced NULL. - (High)
• CVE-2020-7063 Files that Phar::buildFromIterator() added to a tar or zip archive got all-access permissions whatever the mode of the source file, so the files of an archive built from private ones were extracted with all-access permissions. - (Medium)
• CVE-2020-7064 The EXIF reader looked at the byte order marker of a TIFF section in a JPEG without checking that the section had two bytes, so a short section made it use uninitialised memory. - (Medium)
• CVE-2020-7066 get_headers() accepted a URL with a NUL byte and used it only up to that byte, so a check on the URL's host or path could be bypassed. - (Medium)
• CVE-2020-7067 urldecode() and rawurldecode() indexed the EBCDIC translation table with a signed char, so a byte above 0x7f read before the table. - (High)
• CVE-2020-7068 phar_parse_zipfile() freed the alias string and then used it as the key when it registered the alias, a use of freed memory. - (Medium)
• CVE-2020-7069 openssl_encrypt() and openssl_decrypt() with an AES-CCM cipher and a 12-byte IV did not tell OpenSSL the IV length, so OpenSSL used CCM's default of 7 bytes: ciphertext and tag came out wrong, and IVs that share their first 7 bytes collided. - (Medium)
• CVE-2020-7070 PHP URL-decoded cookie names, so a cookie named %5f%5fHost-name became __Host-name, which let a cookie set from a less trusted origin pass for a __Host- or __Secure- cookie. - (Medium)
• CVE-2019-18218 The bundled libmagic's parser for Microsoft Compound Document (CDF/OLE2) files did not limit the element count of a vector property, so a crafted file made cdf_read_property_info() overflow a heap buffer.
• GHSA-m3wq-j48p-jxwh The bundled libzip 1.1.2 keeps the names of an archive in a table with an unkeyed string hash, so a crafted archive can put many names in one bucket and make opening it slow (hash flooding).
• CVE-2021-40812 The bundled libgd's WebP writer, gdImageWebpCtx(), ignored the result of gdPutBuf(), so an output that was written short (a failing stream, a full disk) was reported as written. - (Medium)
• CVE-2016-3191 The bundled PCRE 8.38 has memory-safety and stack-exhaustion bugs in its pattern compiler and matcher (CVE-2016-3191, CVE-2017-6004, CVE-2017-7186, CVE-2019-20838, CVE-2020-14155), fixed in PCRE 8.39 to 8.44, and a match recursion that a crafted pattern or subject drives until the stack is exhausted (CVE-2017-11164, CVE-2017-16231), which no PCRE release limits.
• CVE-2019-16163 The bundled Oniguruma 5.9.6, mbstring's regex library, has four bugs fixed in 6.9.3 and 6.9.4: a pattern nested deeply enough exhausts the stack (CVE-2019-16163), a case-insensitive string compare reads past the end of its string (CVE-2019-19246), a brace interval at the end of a pattern is read past the end (CVE-2019-19204), and a search range is computed with pointer arithmetic that can overflow (CVE-2019-19012).
• CVE-2019-16168 The bundled SQLite 3.28.0 is affected by the 35 advisories of the entry: memory-safety, logic and denial-of-service bugs in the library fixed in releases from 3.28.1 to 3.54.1. - (Medium)
• CVE-2024-2408 The Marvin attack: RSA decryption with PKCS#1 v1.5 padding (OPENSSL_PKCS1_PADDING, the default of openssl_private_decrypt()) leaks through timing whether the padding was valid, so an attacker who can submit many ciphertexts and time the answers can decrypt a ciphertext or forge a signature. - (Medium)

Upgrade notes

• This is the first release of NES for PHP 7.1, for Amazon Linux 2 (x86_64 and aarch64). There are no container images and no Windows zip for PHP 7.1.
• php -v and PHP_VERSION report 7.1.33-nes, so version_compare(PHP_VERSION, '7.1.33', '>=') is false. PHP_VERSION_ID stays 70133, and extensions built for PHP 7.1 load as before.
• The packages replace those of Amazon Linux 2's php7.1 extras topic under the same names: php, php-cli, php-fpm, php-mysqlnd and the rest. A release sorts above the topic's last one (7.1.33-1.amzn2), so yum update moves a host to it (see Installation). If apcu-panel is installed, remove it first: it requires the topic's exact php-pecl-apcu. The topic's other PECL extensions keep loading.
• The packages build the extensions that the topic's packages build, except imap, interbase/pdo_firebird, pdo_dblib and tidy, which are not built, because Amazon Linux 2 does not ship the libraries they need. PHP 7.1 has no sodium extension.
• zip is PHP's own extension, version 1.13.5, in php-common; it replaces the topic's php-pecl-zip package, which carried version 1.15.2. php-pecl-apcu is APCu 5.1.28. php-pear is PEAR 1.10.18; with php-devel (and a compiler), pecl install works.
• PHP's bundled PCRE, Oniguruma (mbstring) and libgd are part of the packages, so fixes to them come with NES for PHP releases. SQLite, libzip, libxml2, ICU, libcurl, libpq and the other system libraries are Amazon Linux 2's, and their fixes come with the operating system's updates. AWS ended standard support for Amazon Linux 2 on 2026-06-30.
• PHP's OpenSSL extension is built against openssl11 (OpenSSL 1.1.1). curl, pgsql, ldap and snmp link Amazon Linux 2's own OpenSSL 1.0.2k-fips, so a PHP process loads both, and TLS through those four runs on 1.0.2k. php -i reports the extension's OpenSSL only.
• Behaviour changes. This release changes the following defaults and behaviours of PHP 7.1.33. Check them against your application before you upgrade:
  • LOAD DATA LOCAL INFILE is off by default. mysqli.allow_local_infile defaults to 0 (it was 1, and php.ini-production, php.ini-development and the packaged php.ini now show the commented default as Off), and a PDO MySQL connection allows it only when it is opened with PDO::MYSQL_ATTR_LOCAL_INFILE => true. When a server asks for a local file on a connection that does not allow it, PHP sends no file: the query fails with client error 2000 ("LOAD DATA LOCAL INFILE is forbidden, check mysqli.allow_local_infile") and a "LOAD DATA LOCAL INFILE forbidden" warning. With the old default a hostile or impersonated MySQL server could read any file the PHP process can read. Code that loads local files sets mysqli.allow_local_infile = On in php.ini, or passes PDO::MYSQL_ATTR_LOCAL_INFILE => true, and should do so only for a server it trusts.
  • Session upload progress is off. session.upload_progress.enabled defaults to Off in the compiled default, in php.ini-production and php.ini-development and in the packaged php.ini, and the upload progress handler does nothing even when the setting is On: no upload progress data is written to the session. This mitigates CVE-2026-115560, which needs session upload progress and has no upstream fix yet; the fix will follow in a later release.
  • A script that exceeds memory_limit, or hits one of the engine's allocation size overflow checks, ends its process with exit status 1. The "Allowed memory size exhausted" fatal error is still written to stderr, and to the error log when errors are logged (with php-fpm, the pool's error log), but no error handler, shutdown function, destructor or output buffer flush runs after it. php-fpm replaces the worker; the CLI exits with status 1. Raise memory_limit where a script needs more. This is the mitigation of CVE-2026-109618 and CVE-2026-109619.
  • Cookie names are no longer URL-decoded: a client that sends an encoded name, such as %5f%5fHost-name, gets that encoded name in $_COOKIE.
  • When a redirect goes to another host, port or scheme, the HTTP stream wrapper drops the Authorization and Cookie headers of the stream context's header option, and its Proxy-Authorization header when no proxy is used (the fix for CVE-2026-91766). On a 307 or 308 redirect it repeats the request with the same method and body instead of switching to GET.
  • Phar and PharData reject a tar archive whose entry size is not plain octal or is about 4 GiB or more ("invalid entry size"), and a tar archive with a GNU long link record ("unsupported GNU long link entry").
  • Multipart form uploads are limited to max_multipart_body_parts parts (the fix for CVE-2023-0662). Its default, -1, means max_input_vars plus max_file_uploads; the parts after the limit are not processed, and a warning is logged. Set max_multipart_body_parts in php.ini if your forms need more.
  • On 64-bit builds an array cannot have 2^30 (1,073,741,824) or more slots; asking for one is a fatal error.
  • yield from a generator that was aborted, for example one that threw an exception, now throws an Error ("Generator passed to yield from was aborted without proper return and is unable to continue"), as PHP 8.0 does; before, the expression evaluated to null. This comes with the fix for a use-after-free in generators that are delegated to by more than one yield from.
  • Extensions built outside these packages that use the engine's generator internals (generator-aware profilers, tracers and debuggers) must be rebuilt with this release's php-devel: built against other PHP 7.1 headers, they can return the wrong generator or crash. The extensions in these packages, APCu included, are already built against it.
  • TLS peer verification no longer falls back to the certificate's Common Name when the certificate has a DNS, URI or SRV subjectAltName that does not match the peer name (the fix for CVE-2026-91769). The warning then reads "Peer certificate subjectAltName did not match expected name".