{"id":"EUVD-2026-41918","enisaUuid":"63e539ab-65a2-3444-a256-7b717b64d615","description":"Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.","datePublished":"Jul 6, 2026, 7:16:15 PM","dateUpdated":"Jul 7, 2026, 3:08:53 PM","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv\nhttps://github.com/gohugoio/hugo/pull/15020\nhttps://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372\nhttps://github.com/gohugoio/hugo/releases/tag/v0.163.1\n","aliases":"CVE-2026-58404\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"500bf387-68e9-30cd-905b-0f727bf4c4ec","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"v0.162.0, \u003c v0.163.1"}],"enisaIdVendor":[{"id":"5c987449-3970-360b-ae32-9c8c2e5053fe","vendor":{"name":"gohugoio"}}],"enisaIdVulnerability":[{"id":"5375dc71-7ec1-35ef-8b99-c41f169b32c9","vulnerability":{"id":"CVE-2026-58404","description":"Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.","datePublished":"Jul 6, 2026, 7:16:15 PM","dateUpdated":"Jul 7, 2026, 3:08:53 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv\nhttps://github.com/gohugoio/hugo/pull/15020\nhttps://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372\nhttps://github.com/gohugoio/hugo/releases/tag/v0.163.1\n","enisa_id":"EUVD-2026-41918\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Nov 7, 2026, 7:21:40 AM","vulnerabilityProduct":[{"id":"141a99e0-2fc4-3c81-8521-5061975c2777","product":{"name":"hugo","vendor":{"name":"gohugoio"}},"product_version":"v0.162.0, \u003c v0.163.1"}],"vulnerabilityVendor":[{"id":"6d33bb4c-638a-370a-9d68-376d7a3fc842","vendor":{"name":"gohugoio"}}]}}],"enisaIdAdvisory":[{"id":"8a87c927-16a7-3b8c-ad27-af76b831b89e","advisory":{"id":"RHSA-2026:36862","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Jul 8, 2026, 8:16:29 PM","dateUpdated":"Sep 8, 2026, 12:06:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:36862\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36862.json\n","aliases":"CVE-2026-50133\nCVE-2026-58402\nCVE-2026-58403\nCVE-2026-58404\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"49c3db57-a74d-31eb-9130-2db9e2e58362","product":{"name":"hugo-main@src","vendor":{"name":"Red Hat"}}},{"id":"9ec5bace-2d36-3dd2-9585-a6b6f9d6e72e","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a13e8035-a773-3f92-a83d-87720fd9999c","product":{"name":"hugo-main@x86_64","vendor":{"name":"Red Hat"}}},{"id":"efdf1028-b694-3d4a-90c4-28adde3fb315","product":{"name":"hugo-main@aarch64","vendor":{"name":"Red Hat"}}}]}}]}