Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110240Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Medium 4.8
In plain English
A medium-severity server-side request forgery in lancet from duke-git. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.3%top 73.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/duke-git/lancet/issues/356 issue-tracking, technical-description
- https://github.com/duke-git/lancet/pull/357 patch, issue-tracking
- https://github.com/duke-git/lancet/commit/835111c832939a85416d686a1e99d5fe7060c9b4 patch
- https://github.com/duke-git/lancet/blob/v2.3.9/netutil/net.go#L192-L205 technical-description
- https://github.com/duke-git/lancet/blob/v1.4.6/netutil/net.go#L158-L170 technical-description
- https://github.com/duke-git/lancet product
- VulnCheck Advisory: Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP third-party-advisory