{"id":"GO-2026-5606","revision":"e350f58c1ef94abe862826d20dd7cde4","records":[{"revision":"e350f58c1ef94abe862826d20dd7cde4","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5606","aliases":["CVE-2026-58404","GHSA-r46f-3rpw-hxrv"],"title":"Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo","description":"Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo","state":0,"publishedAt":"2026-07-24T18:35:55+00:00","modifiedAt":"2026-07-24T19:11:46.3947051+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.162.0"},{"kind":"fixed","version":"0.163.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv","https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5606","license":"OSV · upstream source license applies","key":"osv:GO-2026-5606","identifiers":["GO-2026-5606","CVE-2026-58404","GHSA-r46f-3rpw-hxrv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}