r/netsec • u/AlexandreDaubois • 21h ago

CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits

https://daubois.dev/blog/cve-2026-91768-php-fpm-ipv6-allowed-clients-bypass/
81 Upvotes

98% Upvoted

5 comments sorted by

30

u/Youknowimtheman 15h ago

I was about to complain that I found this one. Then saw that it was co-discovery in the credits. haha

26

u/AlexandreDaubois 14h ago

The policy of our security team is to credit all reporters that send the advisory while it’s not published, even if it’s a duplicate!

11

u/RegisteredJustToSay 13h ago

That's a great way to do it! Should be industry standard.

2

u/Kasoo 59m ago

Reading the headline I was thinking this was pretty unconcerning as in most cases /64 should be enough to identify a host anyway, but I hadn't considered the ::/69 implications.

1

u/AlexandreDaubois 3m ago

Yeah it’s not absolutely critical but worth a look anyway