Euriconicacio

**Name of the Vulnerable Software and Affected Versions** Mailpit (affected versions not specified) **Description** The `IsInternalIP` deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix. This allows server-side request forgery (SSRF), a technique where an attacker induces a server to make requests to an unintended location. Attackers can provide hostnames that resolve to these addresses within message content to access the link check API and proxy endpoint, enabling access to internal resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Heym versions prior to 0.0.98 **Description** Authenticated users can connect to internal services because the software fails to apply Server-Side Request Forgery (SSRF) egress guards to the WebSocket Send and WebSocket Trigger nodes. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Attackers can create workflow nodes with arbitrary URLs and headers to access internal services and read responses from the WebSocket Trigger node. **Recommendations** Update to version 0.0.98 or later.

**Name of the Vulnerable Software and Affected Versions** Flyto2 Core versions prior to 2.28.0 **Description** A server-side request forgery guard bypass allows attackers to access internal services by using the unblocked IPv6 address `::`, which the kernel routes to the loopback address similarly to `0.0.0.0`. By submitting requests or triggering 302 redirects, attackers can bypass private IP range and blocked hostname checks within the `is private ip()` function. This affects the `http.get`, `http.request`, and `http.batch` modules, enabling access to services bound to the IPv6 loopback. **Recommendations** Update to version 2.28.0 or later.