The FastCGI client access check in PHP performs a partial comparison of IPv6 addresses, examining only the first 12 bytes of the 16-byte value. This causes the listen.allowed_clients ACL to match on a /96 prefix rather than the full address. An attacker who can generate an IPv6 address that shares those first 96 bits with an allowed address bypasses the filtering and can reach the FastCGI endpoint, obtaining unauthenticated network access to that internal service.

Any PHP Group PHP installation that enables FastCGI client access checks and accepts IPv6 traffic is potentially affected. No specific PHP releases are listed, so any version containing the vulnerable FastCGI code and configured to use IPv6 addresses is at risk.

The CVSS score of 6.5 places this flaw in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation at present. The likely attack vector is remote, requiring only the ability to supply an IPv6 address that shares the allowed /96 prefix. Successful exploitation grants the attacker unauthenticated access to the FastCGI endpoint, potentially exposing internal functionality, but the description does not indicate that further actions such as code execution are guaranteed.