CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Fixed (IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison). (CVE-2026-91768)
Other sources
IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison (memcmp 12 bytes)
— Microsoft
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Frequently Asked Questions
What configurations are exposed to this issue?
The issue affects PHP FastCGI configurations that use the listen.allowed_clients ACL with IPv6 addresses.
What must an attacker be able to do to exploit it?
An attacker would need to connect to the FastCGI listener from an IPv6 address that can bypass the configured listen.allowed_clients ACL because of partial address comparison.
What is the remediation?
Apply the PHP fix referenced in the PHP 8.3.35 changelog. Until patching is possible, restrict network access to the FastCGI listener using controls outside of the affected PHP ACL.