As it's pointed at the 3rd comment https://issues.apache.org/bugzilla/show_bug.cgi?id=56084#c3 This is just a mis-configuration not a bug.

  Hans 2014-01-29 04:31:41 UTC

  It's an Apache misconfiguration that's not pointed out very clearly.

  The following is the fix:
        <Location /fcgi-php-fpm>
            # here we prevent direct access to this Location url,
            # env=REDIRECT_STATUS will let us use this fcgi-bin url
            # only after an internal redirect (by Action upper)
            Order Deny,Allow
            Deny from all
            Allow from env=REDIRECT_STATUS
        </Location>

  It would be useful to point this out somewhere.

  The above restricts direct access, but not internal access via PHP-FPM sockets.