CVE-2026-91768GHSA-62xp-839h-2637
PHP: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
PHP Group PHPRuntimes & languagesCVSS
6.5MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.2.34PHPCVE List
- 8.3.35PHPCVE List
- 8.4.26PHPCVE List
- 8.5.11PHPCVE List
- 8.2.34PHP-FPM, phpGitHub
- 8.3.35PHP-FPM, phpGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
Text from CVE List
Affected versions 8
- PHPaffected: 8.2.* before 8.2.34CVE List
- PHPaffected: 8.3.* before 8.3.35CVE List
- PHPaffected: 8.4.* before 8.4.26CVE List
- PHPaffected: 8.5.* before 8.5.11CVE List
- PHP-FPM, php<8.2.34GitHub
- PHP-FPM, php<8.3.35GitHub
- PHP-FPM, php<8.4.26GitHub
- PHP-FPM, php<8.5.11GitHub