CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

CVE-2026-54452

safeurl (github.com/doyensec/safeurl), a Go SSRF protection library, has an incomplete IPv6 private network blocklist in ip.go prior to v0.2.4 . Four newly assigned CIDR ranges are omitted: 64:ff9b:1::/48 (NAT64, RFC 8215), 5f00::/16 (Segment Routing SIDs, RFC 9602), 3fff::/20 (documentation, RFC...

CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

EUVD-2026-77630

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

CVE-2026-54452: Server-Side Request Forgery (SSRF)

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

CVE-2026-54492

Koel (open-source music streaming) versions prior to 9.7.0 are vulnerable to an authenticated blind SSRF via the Subsonic-compatible createPodcastChannel.view route. The CreatePodcastChannelRequest.php validator omits the SafeUrl rule applied by the regular podcast API, allowing an authenticated ...

CVE-2026-54492 Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular...

Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to missing SafeUrl validation on the Subsonic-compatible podcast creation endpoint, which allows an authenticated attacker to make the server fetch arbitrary private URLs during podcast parsing...

GO-2026-5997 safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl

safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl...

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

GHSA-W79M-F3JX-779V Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

PT-2026-21933

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 137 Description esm.sh is susceptible to a full-response Server-Side Request Forgery SSRF issue. This allows an attacker to retrieve information from internal websites. The issue resides in the routing logic,...

EUVD-2023-0298

Malicious code in bioql PyPI...

CVE-2023-24622

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

SafeURL-Python's hostname blocklist does not block FQDNs

Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host e.g. adding . to the end. Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library us...

GHSA-373W-RJ84-PV6X SafeURL-Python's hostname blocklist does not block FQDNs

Description If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host e.g. adding . to the end. Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library us...

PT-2023-32967 · Pypi · Safeurl-Python

Name of the Vulnerable Software and Affected Versions: safeurl-python affected versions not specified Description: The issue allows bypassing of blacklisted hostnames by requesting the FQDN of the host, for example, by adding a . to the end. This could enable an attacker to circumvent blocks set ...

Withdrawn: safeurl-python contains Server-Side Request Forgery

Withdrawn This advisory has been withdrawn as a duplicate of GHSA-jgh8-vchw-q3g7. Original Description isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

GHSA-RW83-V3PW-M362 Withdrawn: safeurl-python contains Server-Side Request Forgery

Withdrawn This advisory has been withdrawn as a duplicate of GHSA-jgh8-vchw-q3g7. Original Description isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...