CVE-2026-121619

The Symfony FrameworkBundle (framework.trusted_proxies option) and HttpFoundation (Request::setTrustedProxies() method) are vulnerable to IP spoofing when the private_ranges shortcut is used. The root cause is that private_ranges resolves to a list that includes IPv6 prefixes embedding IPv4 addre...

CLEANSTART-2026-BS55103 various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms

Security vulnerability affects the argo-workflows package. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Linux Distros Unpatched Vulnerability : CVE-2026-123603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1...

DEBIAN-CVE-2026-123603

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use...

CVE-2026-123603

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use...

EUVD-2026-119362

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use...

Hickory DNS permission and access control issue vulnerability

Hickory DNS has a permission and access control vulnerability. This vulnerability arises from the failure to normalize IPv4-mapped IPv6 addresses when checking for denyanswers, denyserver, or AccessControlSet rules. It may allow attackers to bypass response filtering by using IPv4-mapped addresse...

PT-2026-139884

Name of the Vulnerable Software and Affected Versions hickory-proto versions 0.26.0 through 0.26.1 hickory-resolver versions 0.26.0 through 0.26.1 hickory-server versions 0.25.0-alpha.1 through 0.26.1 hickory-recursor versions 0.25.0-alpha.3 through 0.26.0-alpha.1 Description The software fails t...

CVE-2026-122140

A flaw was found in trawl. This issue allows an unauthenticated remote attacker to bypass outbound URL security controls by supplying IPv4-mapped IPv6 addresses directly or through redirects. Successful exploitation of this Server-Side Request Forgery SSRF vulnerability allows an attacker to quer...

CVE-2026-123125 Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery SSRF in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...

CVE-2026-122140

The software Trawl versions 1.5.0 before 1.10.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This vulnerability allows unauthenticated attackers to bypass the MCP outbound URL policy by utilizing IPv4-mapped IPv6 addresses . Attackers can provide hex-normalized addresses (e.g., ::ffff:...

CVE-2026-122140 Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...

CVE-2026-122140 Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...

EUVD-2026-117094

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...

PT-2026-137162

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...

CLEANSTART-2026-JI73434 various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms

Security vulnerability affects the argo-workflows package. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CLEANSTART-2026-DM01376 various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms

CVE-2024-24790 affects multiple packages. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. See references for individual vulnerability details...

Security Bulletin: Vulnerability in prox-addr Node.js module

Summary Vulnerability in prox-addr Node.js module Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust...

CVE-2026-115729 @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...

proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...