CVE-2026-91768

Received Received - Intake

FastCGI IPv6 Address Spoofing via /96 Prefix Matching

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: PHP Group

Description

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-91768

Affected Vendors & Products

Vendor	Product	Version / Range
php	fastcgi	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1023	The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the IPv6 address comparison logic of a FastCGI client access check. Instead of comparing the full 16-byte IPv6 address, only the first 12 bytes are checked. This means an attacker can use an address that shares the first 96 bits with an allowed address to bypass the access control and reach the FastCGI endpoint.

Detection Guidance

This vulnerability involves an IPv6 address comparison flaw in FastCGI client access checks. To detect it, inspect FastCGI configurations for allowed_clients settings and verify if they use IPv6 addresses. Check logs for unexpected access attempts from IPv6 addresses sharing the first 96 bits with allowed clients.

Impact Analysis

If you use FastCGI with IPv6 addresses, an attacker could exploit this to gain unauthorized access to your FastCGI endpoint. This could lead to data exposure, unauthorized actions, or further compromise of your system depending on the endpoint's functionality.

Compliance Impact

This vulnerability allows unauthorized access to FastCGI endpoints by bypassing IP-based restrictions, which could lead to data exposure or unauthorized processing. This may violate GDPR's data protection requirements for secure access controls and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update PHP to the latest version that fixes this issue. Review and restrict allowed_clients in FastCGI configurations to exact IPv6 addresses instead of relying on prefix matching. Monitor network traffic for unauthorized access attempts to FastCGI endpoints.

Hi! I’m here to help you understand CVE-2026-91768. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70