Threats tagged 'bit-libphp-2026-91768'

A vulnerability in libphp's FastCGI IPv6 client access check causes an ACL bypass due to partial address comparison. The check compares only the first 12 bytes of a 16-byte IPv6 address, effectively matching on a /96 prefix rather than the full address. This allows an attacker with an IPv6 address sharing the first 96 bits of an allowed client to bypass access controls and reach the FastCGI endpoint.