CVE-2026-91768

MEDIUMCVSS 6.5

Description

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

Timeline

Published:September 25th, 2026 10:18 PM

Last modified:September 29th, 2026 9:27 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-1023

References & Reports

Advisories, patches, and third-party reports

https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637

Source: NIST NVD · Data may lag official sources by up to one minute