https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T16:30:28.945313+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-54452 fkie_cve-2026-54452 2026-10-05T16:30:28.989076+00:00

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.

 https://vulnerability.circl.lu/vuln/ghsa-xgch-x3mx-cm3c GHSA-xgch-x3mx-cm3c — safeurl is Missing IPv6 CIDR Ranges in Blocklist 2026-10-05T16:30:28.989187+00:00

Affected: Go: github.com/doyensec/safeurl

The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - `64:ff9b:1::/48`: NAT64 local-use prefix (RFC 8215) - `5f00::/16`: Segment Routing (SRv6) SIDs (RFC 9602) - `3fff::/20`: documentation prefix (RFC 9637) - `100:0:0:1::/64`: Dummy IPv6 Prefix (RFC 9780)

### Impact If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges.

### Workarounds Disable IPv6 by setting `EnableIPv6(false)`. This is the default behavior of the library.

### Resolution Upgrade to v0.2.4

### Credits safeurl thanks @tonghuaroot for reporting.