CVE-2026-54452Published

safeurl: Missing IPv6 CIDR Ranges in Blocklist

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-54452

Published

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.

Source published: 14 Sep 2026 16:14:32 UTC
Source modified: 16 Sep 2026 15:16:53 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

euvd · EUVD-2026-77630

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 14, 2026, 4:14:32 PM

dateUpdated: Sep 16, 2026, 3:16:53 PM

Source published: Sep 14, 2026, 4:14:32 PM (timezone not stated)
Source modified: Sep 16, 2026, 3:16:53 PM (timezone not stated)
Observed here: 11 Nov 2026 14:00:19 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

nvd · CVE-2026-54452

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-918

Original publisher date fields

published: 2026-09-14T17:17:47.330

lastModified: 2026-09-30T17:51:56.193

Source published: 14 Sep 2026 17:17:47 UTC
Source modified: 30 Sep 2026 17:51:56 UTC
Observed here: 25 Oct 2026 13:17:28 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv · GHSA-xgch-x3mx-cm3c

Published

The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - `64:ff9b:1::/48`: NAT64 local-use prefix (RFC 8215) - `5f00::/16`: Segment Routing (SRv6) SIDs (RFC 9602) - `3fff::/20`: documentation prefix (RFC 9637) - `100:0:0:1::/64`: Dummy IPv6 Prefix (RFC 9780) ### Impact If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges. ### Workarounds Disable IPv6 by setting `EnableIPv6(false)`. This is the default behavior of the library. ### Resolution Upgrade to v0.2.4 ### Credits safeurl thanks @tonghuaroot for reporting.

Source published: 15 Jul 2026 21:58:03 UTC
Source modified: 21 Jul 2026 19:19:10 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Publisher rating · MODERATE

osv · GO-2026-5997

Published

safeurl is Missing IPv6 CIDR Ranges in Blocklist in github.com/doyensec/safeurl

Source published: 17 Jul 2026 19:42:05 UTC
Source modified: 21 Jul 2026 19:15:35 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.