CVE-2026-58404

Name of the Vulnerable Software and Affected Versions Hugo versions 0.162.0 through 0.163.0

Description The default security.http.urls policy fails to properly block requests to loopback, internal, and cloud-metadata IPv4 literals because the deny rule only matches dotted-decimal notation. Consequently, alternate IPv4 encodings such as integer, hex, or octal bypass the policy. When a template provides an untrusted or data-derived URL to the resources.GetRemote() function and the host platform utilizes the cgo system resolver, these encodings resolve to blocked addresses. This allows unauthorized build-time server-side requests to loopback and internal services, including cloud-metadata endpoints in hosted or CI builds. This bypass also applies to each redirect hop as the same check is reused.

Recommendations Update to version 0.163.1.