r/netsec • u/AlexandreDaubois • 2d ago

CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits

https://daubois.dev/blog/cve-2026-91768-php-fpm-ipv6-allowed-clients-bypass/
100 Upvotes

99% Upvoted

5 comments sorted by

48

u/Youknowimtheman 2d ago

I was about to complain that I found this one. Then saw that it was co-discovery in the credits. haha

42

u/AlexandreDaubois 2d ago

The policy of our security team is to credit all reporters that send the advisory while it’s not published, even if it’s a duplicate!

20

u/RegisteredJustToSay 2d ago

That's a great way to do it! Should be industry standard.

4

u/Kasoo 2d ago

Reading the headline I was thinking this was pretty unconcerning as in most cases /64 should be enough to identify a host anyway, but I hadn't considered the ::/69 implications.

1

u/AlexandreDaubois 2d ago

Yeah it’s not absolutely critical but worth a look anyway