Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-91768

Fixed in a distro release EPSS <1%CVSS 6.5

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

Published 2026-09-25 · CVE record · OSV

Products: PHP Group PHP

Distro releases

ReleasePackageFixed in
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-bcmath7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-cli7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-common7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-dba7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-dbg7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-devel7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-embedded7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-enchant7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-ffi7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-fpm7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-gd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-gmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-intl7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-json7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-ldap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-mbstring7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-mysqlnd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-odbc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-opcache7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-pdo7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pgsql7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-process7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-snmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-soap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-xml7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux:8php-xmlrpc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
Debian:12php8.28.2.34-1~deb12u1
Debian:13php8.48.4.26-1~deb13u1
Debian:14php8.48.4.26-1
Red Hat:hummingbird:1php0:8.5.11-2.hum1
Red Hat:hummingbird:1php-bcmath0:8.5.11-2.hum1
Red Hat:hummingbird:1php-cli0:8.5.11-2.hum1
Red Hat:hummingbird:1php-common0:8.5.11-2.hum1
Red Hat:hummingbird:1php-dba0:8.5.11-2.hum1
Red Hat:hummingbird:1php-dbg0:8.5.11-2.hum1
Red Hat:hummingbird:1php-devel0:8.5.11-2.hum1
Red Hat:hummingbird:1php-embedded0:8.5.11-2.hum1
Red Hat:hummingbird:1php-enchant0:8.5.11-2.hum1
Red Hat:hummingbird:1php-ffi0:8.5.11-2.hum1
Red Hat:hummingbird:1php-fpm0:8.5.11-2.hum1
Red Hat:hummingbird:1php-gd0:8.5.11-2.hum1
Red Hat:hummingbird:1php-gmp0:8.5.11-2.hum1
Red Hat:hummingbird:1php-intl0:8.5.11-2.hum1
Red Hat:hummingbird:1php-ldap0:8.5.11-2.hum1
Red Hat:hummingbird:1php-mbstring0:8.5.11-2.hum1
Red Hat:hummingbird:1php-mysqlnd0:8.5.11-2.hum1
Red Hat:hummingbird:1php-odbc0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo-dblib0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pdo-firebird0:8.5.11-2.hum1
Red Hat:hummingbird:1php-pgsql0:8.5.11-2.hum1
Red Hat:hummingbird:1php-process0:8.5.11-2.hum1
Red Hat:hummingbird:1php-snmp0:8.5.11-2.hum1
Red Hat:hummingbird:1php-soap0:8.5.11-2.hum1
Red Hat:hummingbird:1php-sodium0:8.5.11-2.hum1
Red Hat:hummingbird:1php-tidy0:8.5.11-2.hum1
Red Hat:hummingbird:1php-xml0:8.5.11-2.hum1
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1912+72767185
Rocky Linux:8php0:7.4.33-8.module+el8.10.0+40393+c071e357
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1605+02e07af7
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.4.0+414+2e7afcdd
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1912+72767185
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Module for Legacy 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Legacy 15 SP7php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-embed7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Module for Package Hub 15 SP7php7-test7.4.33-150400.4.81.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7apache2-mod_php88.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php88.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-embed8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-fastcgi8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-fpm8.3.35-150700.3.21.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7php8-test8.3.35-150700.3.21.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server 15 SP5-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server 15 SP6-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSapache2-mod_php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-embed8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-fastcgi8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-fpm8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 15 SP6-LTSSphp8-test8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server 16.0apache2-mod_php88.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php88.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-embed8.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-fastcgi8.4.26-160000.1.1
SUSE:Linux Enterprise Server 16.0php8-fpm8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4php8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php88.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-embed8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-fastcgi8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-fpm8.0.30-150400.4.76.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5php8-test8.0.30-150400.4.76.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php77.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php7-fastcgi7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php7-fpm7.4.33-150400.4.81.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php88.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-embed8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-fastcgi8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-fpm8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6php8-test8.2.34-150600.3.36.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-mod_php88.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php88.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-embed8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-fastcgi8.4.26-160000.1.1
SUSE:Linux Enterprise Server for SAP applications 16.0php8-fpm8.4.26-160000.1.1
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.27
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.12
Ubuntu:26.04:LTSphp8.58.5.4-0ubuntu1.4
Ubuntu:26.10php8.58.5.9-0ubuntu2
Ubuntu:Pro:14.04:LTSphp55.5.9+dfsg-1ubuntu4.29+esm17
Ubuntu:Pro:16.04:LTSphp7.07.0.33-0ubuntu0.16.04.16+esm21
Ubuntu:Pro:18.04:LTSphp7.27.2.24-0ubuntu0.18.04.17+esm13
Ubuntu:Pro:20.04:LTSphp7.47.4.3-4ubuntu2.29+esm4
openSUSE:Leap 16.0apache2-mod_php88.4.26-160000.1.1
openSUSE:Leap 16.0php88.4.26-160000.1.1
openSUSE:Leap 16.0php8-embed8.4.26-160000.1.1
openSUSE:Leap 16.0php8-fastcgi8.4.26-160000.1.1
openSUSE:Leap 16.0php8-fpm8.4.26-160000.1.1
openSUSE:Leap 16.0php8-test8.4.26-160000.1.1
openSUSE:Tumbleweedphp88.5.11-1.1