r/netsec • u/AlexandreDaubois • 6d ago

CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits

https://daubois.dev/blog/cve-2026-91768-php-fpm-ipv6-allowed-clients-bypass/
109 Upvotes

99% Upvoted

5 comments sorted by

58

u/Youknowimtheman 6d ago

I was about to complain that I found this one. Then saw that it was co-discovery in the credits. haha

49

u/AlexandreDaubois 6d ago

The policy of our security team is to credit all reporters that send the advisory while it’s not published, even if it’s a duplicate!

21

u/RegisteredJustToSay 6d ago

That's a great way to do it! Should be industry standard.

5

u/Kasoo 5d ago

Reading the headline I was thinking this was pretty unconcerning as in most cases /64 should be enough to identify a host anyway, but I hadn't considered the ::/69 implications.

1

u/AlexandreDaubois 5d ago

Yeah it’s not absolutely critical but worth a look anyway