PT-2026-60376 · Pypi · Safecurl

CVE-2026-54452

·

Published

2026-07-15

·

Updated

2026-07-30

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions safeurl versions prior to 0.2.4
Description The privateNetworks blocklist fails to include several newly added IPv6 CIDR ranges, specifically 64:ff9b:1::/48 (NAT64 local-use prefix), 5f00::/16 (Segment Routing SIDs), 3fff::/20 (documentation prefix), and 100:0:0:1::/64 (Dummy IPv6 Prefix). This omission could allow an attacker to reach resources hosted on IP addresses within these missing ranges.
Recommendations Upgrade to version 0.2.4. As a temporary workaround, disable IPv6 by setting EnableIPv6(false).

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-54452
GHSA-XGCH-X3MX-CM3C
GO-2026-5997
OPENSUSE-SU-2026:21483-1

Affected Products

Safecurl