CVE-2026-91768

Access control bypass via partial IPv6 address comparison

Publication Date 2026-09-25
Severity Moderate
Type Information Disclosure
Affected PHP Versions
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.33
  • 8.3.0-8.3.34
  • 8.4.0-8.4.25
  • 8.5.0-8.5.10
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.8

CVE Details

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker on an adjacent network with an address sharing the first 96 bits with an authorized client can bypass network access restrictions to reach the FastCGI endpoint, potentially leading to unauthorized information disclosure.

Recommendations

If you are using the listen.allowed_clients configuration with PHP-FPM, and provide IPv6 addresses, we recommend updating to a patched version of PHP.