Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-58404 · Microsoft / collected KEV context

EUVD-2026-41918

GHSA-r46f-3rpw-hxrv

GO-2026-5606

cve-program · CVE-2026-58404

• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv
• https://github.com/gohugoio/hugo/pull/15020
• https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1

euvd · EUVD-2026-41918

• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv
• https://github.com/gohugoio/hugo/pull/15020
• https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1

nvd · CVE-2026-58404

• https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372
• https://github.com/gohugoio/hugo/pull/15020
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1
• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv

osv · GHSA-r46f-3rpw-hxrv

• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv
• https://github.com/gohugoio/hugo

osv · GO-2026-5606

• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv
• https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372

No related operational record is retained in the current change model.