CVE-2009-3291: PHP

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.

Affected products

• PHP PHP: up to and including 5.2.10; version 1.0 only; version 2.0 only; version 2.0b10 only; version 3.0 only; version 3.0.1 only; …

Published 2009-09-22. Last modified 2026-06-16.