Incorrect Comparison in PHP - CVE-2026-91768
Published: September 24, 2026
Vulnerability identifier: #VU151923
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91768
CWE-ID: CWE-697
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass the FastCGI access control and access the endpoint.
The vulnerability exists due to an incorrect comparison in fcgi_is_allowed() in main/fastcgi.c when validating IPv6 client addresses against listen.allowed_clients. A remote attacker can send a FastCGI request from an IPv6 address sharing the first 96 bits with an allowed address to bypass the FastCGI access control and access the endpoint.
Only deployments using FastCGI over IPv6 TCP and relying on listen.allowed_clients as a security boundary are affected.
Affected software
PHP
How to mitigate CVE-2026-91768
Install security update from vendor's website.
PHP - addressed in versions 8.2.34, 8.3.35, 8.4.26, 8.5.11