Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-91768— IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

Quick assessment

Affected
PHP Group PHP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

IPv6 分支的 FastCGI 客户端访问检查仅比较 16 字节 IPv6 地址的前 12 个字节，因此 listen.allowed_clients 匹配的是 /96 前缀，而非精确的地址。攻击者如果使用的源地址与允许的地址在前 96 位相同，即可通过该检查，从而访问 FastCGI 端点。

CVSS 6.5 · Medium EPSS 0.56% · P44
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91768

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Source: CVE Program / CVE List V5
Vulnerability Description
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺失要素致使对比不完全
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHP Group PHP 8.2.* ~ 8.2.34 -

II. Public POCs for CVE-2026-91768

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91768

请登录查看更多情报信息。

Other References for CVE-2026-91768 (1)

Same Patch Batch · PHP Group · 2026-09-25 · 11 CVEs total

CVE-2026-91765 7.5 HIGH SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
CVE-2026-17545 6.9 MEDIUM PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can ca
CVE-2026-91767 6.5 MEDIUM Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard
CVE-2025-14181 6.5 MEDIUM Integer overflow to buffer overflow in soap HTTP parsing
CVE-2026-92842 5.9 MEDIUM OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
CVE-2026-91766 5.9 MEDIUM Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-93682 5.8 MEDIUM Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Loca
CVE-2026-6103 4.3 MEDIUM Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
CVE-2026-91769 4.3 MEDIUM TLS Hostname Verification Falls Back to CN After SAN Mismatch
CVE-2025-1218 3.4 LOW Various packet overreads in mysqlnd_writeprotocol.c

IV. Related Vulnerabilities

Same product: PHP
Same vendor: PHP Group
Same weakness: CWE-1023

V. Comments for CVE-2026-91768

No comments yet

Leave a comment