New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33655 · Microsoft / collected KEV context

EUVD-2026-42749

GHSA-6qcr-qxgr-m7fv

GO-2026-5930

cve-program · CVE-2026-33655

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv
• https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1

euvd · EUVD-2026-42749

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv
• https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1

nvd · CVE-2026-33655

• https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743
• https://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv

osv · GHSA-6qcr-qxgr-m7fv

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv
• https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743
• https://github.com/QuantumNous/new-api

osv · GO-2026-5930

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv
• https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743

No related operational record is retained in the current change model.