CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits
CVEvulnerabilityFastCGIPHP-FPMIPv6securityallowed_clients
The Reddit post references CVE-2026-91768, a vulnerability related to PHP-FPM's FastCGI allowed_clients feature and IPv6 address handling. The vulnerability involves the comparison of only 96 bits of an IPv6 address's 128 bits. A link to a detailed blog post at daubois.dev is provided.