Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-91768: PHP FastCGI IPv6 check allows similar addresses
CVE-2026-91768 · published 1 month ago
Summary
Certain PHP FastCGI versions on Debian and Ubuntu only compare the first three parts of an IPv6 address when deciding which clients may connect. This means a remote user whose address shares the first 96 bits with an allowed address can bypass the restriction and reach the FastCGI service. Apply the latest PHP security updates or adjust the configuration to require exact address matching or use IPv4 addresses only.
What to do
- Update debian php8.4 to version 8.4.26-1~deb13u1.
- Update bellsoft php83 to version 8.3.35-r0.
- Update libphp to version 8.5.11.
- Update php to version 8.5.11.
- Update php-min to version 8.5.11.
- Update debian php8.2 to version 8.2.34-1~deb12u1.
- Update php group php to version 8.2.34 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | php8.2 |
< 8.2.34-1~deb12u1 Fix: upgrade to 8.2.34-1~deb12u1
|
| Debian:13 | debian | php8.4 |
< 8.4.26-1~deb13u1 Fix: upgrade to 8.4.26-1~deb13u1
|
| Debian:14 | debian | php8.4 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | php5 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | php7.0 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | php7.2 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | php7.4 | All versions |
| Ubuntu:22.04:LTS | canonical | php8.1 | All versions |
| Ubuntu:24.04:LTS | canonical | php8.3 | All versions |
| Ubuntu:26.04:LTS | canonical | php8.5 | All versions |
| – | php group | php | < 8.2.34 |
| Alpaquita:25 | bellsoft | php83 |
>= 8.3.21-r0, < 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
| Alpaquita:stream | bellsoft | php83 |
>= 8.3.4-r2, < 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
| Bitnami | – | libphp |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| Bitnami | – | php |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| Bitnami | – | php-min |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| – | php | php |
>= 8.2.0, < 8.2.34 >= 8.3.0, < 8.3.35 >= 8.4.0, < 8.4.26 >= 8.5.0, < 8.5.11 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* |
Original advisory text
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
References
- https://security-tracker.debian.org/tracker/CVE-2026-91768 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-91768 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-91768 Third Party Advisory
- https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637 Vendor Advisory
- https://github.com/php/php-src/blob/php-8.4.26/NEWS Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-91768 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-91768 URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-1023Incomplete Comparison with Missing Factors
Timeline
Published1 Oct 2026
Updated4 Nov 2026
First seen24 Sep 2026
Sources
DEBIAN-CVE-2026-91768 · OSV
UBUNTU-CVE-2026-91768 · OSV
CVE-2026-91768 · NVD
CVE-2026-91768 · MITRE
BELL-CVE-2026-91768 · OSV
BIT-php-min-2026-91768 · OSV
BIT-libphp-2026-91768 · OSV
Track software like this
Free during beta