CVE-2026-91768: PHP PHP vulnerability
Published Sep 24, 2026
·Updated
Fixed (IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison). (CVE-2026-91768)
Affected Software
1 affected componentFixes available
PHP PHP<8.4.26
8.4.26
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26
Event History
Sep 24, 2026
CVE Published
via PHP·12:00 AM
Data Sourced
via PHP·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What configurations are exposed to this issue?
The issue affects PHP FastCGI configurations that use the listen.allowed_clients ACL with IPv6 addresses.
2
What must an attacker be able to do to exploit it?
An attacker would need to connect to the FastCGI listener from an IPv6 address that can bypass the configured listen.allowed_clients ACL because of partial address comparison.
3
What is the remediation?
Apply the PHP fix referenced in the PHP 8.3.35 changelog. Until patching is possible, restrict network access to the FastCGI listener using controls outside of the affected PHP ACL.