{"id":"EUVD-2026-60963","enisaUuid":"d487db98-929c-3f1d-b58f-0500d56fc882","description":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.","datePublished":"Aug 18, 2026, 3:21:55 PM","dateUpdated":"Aug 18, 2026, 7:02:07 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh\nhttps://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e\nhttps://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou\n","aliases":"CVE-2026-75856\nGHSA-6v2g-fpxh-pmmh\n","assigner":"VulnCheck","epss":0.5,"enisaIdProduct":[{"id":"3011cc4c-9b04-3148-a08f-324593cc10b7","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.8.5 \u003c0.8.41"},{"id":"f2102408-77eb-3961-a5af-ed9bbded75d2","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.8.41 \u003c0.8.64"}],"enisaIdVendor":[{"id":"f98a9e90-f08b-3479-bf7d-6bf1c7532032","vendor":{"name":"Hmbown"}}],"enisaIdVulnerability":[{"id":"1b8c265b-4e94-30ac-9120-63ea76894898","vulnerability":{"id":"GHSA-6v2g-fpxh-pmmh","description":"CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning","datePublished":"Sep 4, 2026, 6:05:12 PM","dateUpdated":"Sep 4, 2026, 6:05:12 PM","baseScore":0.0,"references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75856\nhttps://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e\nhttps://github.com/Hmbown/CodeWhale\nhttps://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou\n","enisa_id":"EUVD-2026-60963\n","aliases":"CVE-2026-75856\nGHSA-6v2g-fpxh-pmmh\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"30000c82-661f-3a54-b615-1af9eac4f77c","vulnerability":{"id":"CVE-2026-75856","description":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.","datePublished":"Aug 18, 2026, 3:21:55 PM","dateUpdated":"Aug 18, 2026, 7:02:07 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh\nhttps://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e\nhttps://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou\n","enisa_id":"EUVD-2026-60963\n","assigner":"VulnCheck","epss":0.5,"dataProcessed":"Nov 3, 2026, 7:15:15 AM","vulnerabilityProduct":[{"id":"88b0ef24-c24c-30de-8e35-57a7c1932e1d","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.8.41 \u003c0.8.64"},{"id":"f5c93878-0c02-31bc-869c-edd9e6acb4e5","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.8.5 \u003c0.8.41"}],"vulnerabilityVendor":[{"id":"1c69f0b5-d854-381c-86f2-daf9eab74083","vendor":{"name":"Hmbown"}}]}}],"enisaIdAdvisory":[]}