Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73087Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

Low 2.3

In plain English

A low-severity server-side request forgery in dozzle from amir20. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/amir20/dozzle	1.29.1-0.20260804193351-8cf7ccd5ee04	GHSA-p2w3-6x73-2f6x
Go	github.com/amir20/dozzle	1.29.1-0.20260804193351-8cf7ccd5ee04	GO-2026-6440

Affected products (as reported)

Vendor	Product	Versions
amir20	dozzle	< 10.6.15

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x x_refsource_CONFIRM
https://github.com/amir20/dozzle/pull/4887 x_refsource_MISC
https://github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f x_refsource_MISC
https://github.com/amir20/dozzle/releases/tag/v10.6.15 x_refsource_MISC