important · Privilege
PHP-FPM's exact-client IPv6 ACL admits any host in an allowed client's /96.
Affects
PHP-FPM, the FastCGI process manager shipped with PHP on Unix-like web servers.
The check compares only 12 of 16 address bytes, so a nearby IPv6 host can pass listen.allowed_clients and submit FastCGI requests to accessible PHP scripts.
Detail and 1 source
Exposure requires an IPv6-reachable TCP listener and an attacker address sharing the configured client's first 96 bits; patched releases exist for every supported branch.