Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-54452safeurl: Missing IPv6 CIDR Ranges in Blocklist

Medium 6.3

In plain English

A medium-severity server-side request forgery in safeurl from doyensec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.5%top 55.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/doyensec/safeurl0.2.4GHSA-xgch-x3mx-cm3c
Gogithub.com/doyensec/safeurl0.2.4GO-2026-5997

Affected products (as reported)

VendorProductVersions
doyensec safeurl < 0.2.4

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References