Hugo: security.http.urls allow-list bypass via HTTP redirects

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-50134 · Microsoft / collected KEV context

EUVD-2026-41916

GHSA-vxgm-5rmg-5w8g

GO-2026-5681

cve-program · CVE-2026-50134

• https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g
• https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

euvd · EUVD-2026-41916

• https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g
• https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

nvd · CVE-2026-50134

• https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0
• https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g

osv · GHSA-vxgm-5rmg-5w8g

• https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g
• https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
• https://github.com/gohugoio/hugo
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

osv · GO-2026-5681

• https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g
• https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
• https://github.com/gohugoio/hugo/releases/tag/v0.162.0

No related operational record is retained in the current change model.