CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits

[u/AlexandreDaubois]

https://daubois.dev/blog/cve-2026-91768-php-fpm-ipv6-allowed-clients-bypass/

[u/Kasoo]

Reading the headline I was thinking this was pretty unconcerning as in most cases /64 should be enough to identify a host anyway, but I hadn't considered the ::/69 implications.

[u/AlexandreDaubois → u/Kasoo]

Yeah it’s not absolutely critical but worth a look anyway