CVE-2026-91768 in PHP
Summary
by MITRE • 09/25/2026
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability in question stems from a critical implementation flaw within the IPv6 access control logic of the FastCGI client module, specifically affecting how listen.allowed_clients directives are evaluated against incoming connection source addresses. In standard network security practices for IPv4 environments, subnet masks or CIDR notation provide precise boundaries for allowed traffic, but when transitioning to IPv6, developers must ensure that address matching algorithms correctly handle the full 128-bit length of modern IP addresses. The identified defect reveals that the software incorrectly truncates the comparison process by examining only the first ninety-six bits of a sixteen-byte IPv6 address rather than evaluating all one hundred twenty-eight bits. This architectural oversight effectively reduces the security boundary from an exact host match to a broad /96 prefix block, which encompasses approximately two hundred and eighty-one trillion unique IP addresses under any single allowed entry.
From a technical perspective, this flaw represents a classic case of insufficient input validation or incorrect data handling during network address parsing. When a client initiates a connection to the FastCGI endpoint, the server retrieves the source IPv6 address from the socket structure and passes it through an access check routine. Instead of performing a bitwise comparison across the entire sixteen-byte array, the code stops after processing the first twelve bytes. Consequently, any attacker who can configure their system or manipulate routing infrastructure to utilize an IP address that shares the initial ninety-six bits with an authorized internal or trusted address will bypass this security gate entirely. This behavior is particularly dangerous because IPv6 addresses are often dynamically assigned via SLAAC or DHCPv6, making it feasible for attackers in adjacent subnets or compromised networks to predict or select a prefix that aligns with allowed ranges without needing the final thirty-two bits of entropy.
The operational impact of this vulnerability is severe, as it effectively nullifies the intended isolation provided by the listen.allowed_clients configuration directive. FastCGI processes are frequently used to serve dynamic web content and often run under specific user privileges or within isolated environments designed to prevent unauthorized code execution. By bypassing the access control list, an attacker gains direct communication with these backend services without authentication or network-level filtering. This can lead to a range of downstream exploits including remote code execution if the FastCGI application is vulnerable to injection attacks, information disclosure through error messages or data leakage, and denial of service by overwhelming the process with malicious requests. In environments where multiple tenants share infrastructure, this flaw could allow lateral movement from one tenant's network segment into another's protected services simply by aligning on a common prefix.
This vulnerability maps directly to CWE-284 Improper Access Control, as it involves an authorization bypass due to flawed logic in the access verification mechanism. Furthermore, within the MITRE ATT&CK framework, this flaw facilitates Initial Access and potentially Lateral Movement depending on the network topology, allowing adversaries to reach internal services that should be restricted. The specific technique aligns with unauthorized resource access over a network protocol where identity or location-based restrictions are circumvented through address manipulation.
Mitigation strategies must prioritize immediate patching of the affected software version if available from the vendor, as this is fundamentally a code defect requiring source-level correction to ensure full IPv6 address comparison. In the interim, administrators should implement stricter firewall rules at the network perimeter that explicitly deny traffic on ports associated with FastCGI unless it originates from known and verified IP ranges using proper subnet masking rather than relying solely on application-layer access controls. Additionally, deploying intrusion detection systems configured to monitor for anomalous connection patterns or unauthorized protocol usage can provide an additional layer of defense. It is also advisable to review all listen.allowed_clients configurations to ensure they do not inadvertently rely on broad prefixes that might encompass unintended networks, and where possible, restrict access using IPv4-mapped addresses if the infrastructure does not strictly require native IPv6 connectivity for these services until a permanent fix is deployed.