CVE-2026-91768

Published Sep 25, 2026

Last updated a day ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-91768 describes an IPv6 access control bypass vulnerability found in PHP-FPM. This flaw specifically affects the `listen.allowed_clients` configuration due to a partial address comparison mechanism. The vulnerability allows clients to circumvent intended IPv6 Access Control List (ACL) restrictions. This issue has been noted in the context of unpatched Linux distributions, including Debian Linux, and is associated with PHP versions such as php8.2 and php8.4. It is also listed among multiple vulnerabilities affecting PHP 8.3.x versions prior to 8.3.35.

Description: The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
Source: security@php.net
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

security@php.net: CWE-1023

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 16

References