Vulnerability detail
CVE-2026-91768
中PHPに関する脆弱性
公開: 2026/09/26
更新: 2026/10/28
概要
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.