{"id":"GO-2026-5930","revision":"b7d30afc6f6e470089535ff0399ea997","records":[{"revision":"b7d30afc6f6e470089535ff0399ea997","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5930","aliases":["CVE-2026-33655","GHSA-6qcr-qxgr-m7fv"],"title":"New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api","description":"New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs in github.com/QuantumNous/new-api","state":0,"publishedAt":"2026-07-17T19:42:05+00:00","modifiedAt":"2026-07-21T19:15:26.3996996+00:00","affected":[{"ecosystem":"Go","name":"github.com/QuantumNous/new-api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.12.0-alpha.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv","https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5930","license":"OSV · upstream source license applies","key":"osv:GO-2026-5930","identifiers":["GO-2026-5930","CVE-2026-33655","GHSA-6qcr-qxgr-m7fv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}