In X-Forwarded-For header values, IPv6 addresses may be abbreviated by using the two-colon (::) notation to represent contiguous 16-bit fields of zeros.

The pattern IP6_EXACT in ProxyPeerAddressHandler does not match such address strings. Therefore, the peer address set without resolved InetAddress in these cases.

As a result, IPAddressAccessControlHandler doesn't work properly - such "unresolved" source addresses are always denied.

Also, the IPv6 address is not logged via RemoteIPAttribute, which falls back to the underlying HTTP connection, so instead the proxy's IP gets logged.