CVE-2026-84476: Php Forwarded Header Ip Trusted On Private Remote Addrcve-2026-84476-php-forwarded-header-ip-trusted-on-private-remote-addr
A client-supplied forwarding header (X-Forwarded-For, X-Real-IP, Client-IP, Forwarded) is trusted as the client IP whenever the direct peer address (REMOTE_ADDR) merely classifies as private/loopback/internal. Behind a reverse proxy, load balancer, NAT, container ingress or tunnel, REMOTE_ADDR is private for every request, including attacker requests, so thi
