CVE-2026-91768

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. PHP-FPM and php-cgi speak FastCGI to the web server, and the listen.allowed_clients pool setting (or the FCGI_WEB_SERVER_ADDRS environment variable for php-cgi) restricts which client addresses may connect to a TCP listener.

An Access Control Bypass vulnerability (CVE-2026-91768) has been identified in PHP's FastCGI client access check, which allows a host whose IPv6 address shares its first 96 bits with an allowed client to pass listen.allowed_clients and send FastCGI requests to the pool. PHP tracks this issue as GHSA-62xp-839h-2637.

Per MITRE CWE-1023: The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

This issue affects PHP 5.6.4 and later before 8.2.34, PHP 8.3 before 8.3.35, PHP 8.4 before 8.4.26 and PHP 8.5 before 8.5.11, which includes the End-of-Life release lines PHP 5.6 (from 5.6.4), 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 through their final releases.

Details

Module Info

• Product: PHP
• Affected packages: php-src (main/fastcgi.c, sapi/fpm)
• Affected versions: >=5.6.4 <8.2.34, >=8.3.0 <8.3.35, >=8.4.0 <8.4.26, >=8.5.0 <8.5.11
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in PHP 5.6.4 and later before 8.2.34, 8.3 before 8.3.35, 8.4 before 8.4.26 and 8.5 before 8.5.11, including the End-of-Life PHP 5.6 (from 5.6.4), 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 release lines, which never received the upstream fix. The PHP project scores it 6.5 under CVSS 3.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and classifies it as CWE-1023, Incomplete Comparison with Missing Factors.

When a FastCGI connection is accepted on a TCP socket, fcgi_is_allowed() checks the client address against the list built from listen.allowed_clients. IPv4 addresses are compared on all 4 bytes, but IPv6 addresses are compared on only 12 of their 16 bytes. In PHP 7.4.33, the IPv6 branch reads:

if (client_sa.sa.sa_family == AF_INET6) {
    for (i = 0; allowed_clients[i].sa.sa_family ; i++) {
        if (allowed_clients[i].sa.sa_family == AF_INET6
            && !memcmp(&client_sa.sa_inet6.sin6_addr, &allowed_clients[i].sa_inet6.sin6_addr, 12)) {
            return 1;
        } 

Because the last 32 bits are never compared, each allowed IPv6 address in effect allows its whole /96 prefix. Any other host in that range passes the check and can send FastCGI requests to the pool. FastCGI parameters such as SCRIPT_FILENAME come from the client and are trusted by PHP, so a client that can talk to the pool directly can run PHP scripts with parameters of its choice and read the output.

Exploitation needs a php-fpm pool, or php-cgi in FastCGI mode, that listens on an IPv6 address and relies on listen.allowed_clients with IPv6 addresses to keep other hosts out, and an attacker who can connect from an address sharing the first 96 bits with an allowed client. HeroDevs' analysis confirms the same comparison in PHP 5.6, 7.2 and 7.4. Pools that listen on a Unix socket or only on IPv4, or that are protected by a firewall that allows only the web server, are not exposed.

The fix compares the full 16-byte IPv6 address.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, have php-fpm listen on a Unix socket or on a loopback or IPv4 address, or restrict access to the FastCGI port with a firewall rule that allows only the exact web server address.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• l8BL (finder)
• OSTIF-Derek (finder)
• Ilia Alshanetsky (finder)
• Alexandre Daubois (remediation)