CVE-2026-47695

Name of the Vulnerable Software and Affected Versions CC-Tweaked versions prior to 1.119.0

Description An issue exists in the HTTP API where requests to private network ranges are intended to be blocked to prevent server-side request forgery (SSRF). On IPv6-capable servers using NAT64 routing—a common configuration on cloud platforms like AWS and GCP—this protection can be bypassed. An attacker capable of executing Lua code can access internal IPv4 services by using NAT64 well-known prefix addresses (64:ff9b::/96) instead of direct IPv4 addresses. This occurs because the PrivatePattern.matches() function fails to recognize the NAT64 prefix, allowing the request to pass the filter and be translated at the network level to the target internal IPv4 address. The affected API endpoints are http.request and http.websocket.

Recommendations Update to version 1.119.0.