UBUNTU-CVE-2026-100693

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-100693

Hugo versions v0.162.0 before v0.166.0 are affected by a case-sensitive validation flaw within the security.http.urls IP-literal deny rule. This vulnerability allows attackers to bypass security restrictions by using mixed-case URL schemes in resources.GetRemote calls to access restricted IP addr...

CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

EUVD-2026-87666

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-100693 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

CVE-2026-100693: Improper Handling of Case Sensitivity

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

PT-2026-99364

Name of the Vulnerable Software and Affected Versions Hugo versions 0.162.0 through 0.165.0 Description A case-sensitive validation flaw exists in the security.http.urls IP-literal deny rule. This allows attackers to bypass restrictions by using mixed-case URL schemes in resources.GetRemote calls...

Linux Distros Unpatched Vulnerability : CVE-2026-10582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL...

DEBIAN-CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582

Hugo versions 0.91.0 through 0.165.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the security.http.urls allowlist. The allowlist validates only the URL text itself—checking configured patterns and canonicalised IPv4 forms—but never resolves the hostname nor inspects the ...

CVE-2026-10582: Server-Side Request Forgery (SSRF)

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-50134: Server-Side Request Forgery (SSRF)

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...