PT-2026-60376

CVE-2026-54452

·

Published

2026-07-15

·

Updated

2026-09-16

Description by

CVSS 4.0
6.9
Medium
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions safeurl versions prior to 0.2.4
Description The privateNetworks blocklist fails to include several newly added IPv6 CIDR ranges, specifically 64:ff9b:1::/48 (NAT64 local-use prefix), 5f00::/16 (Segment Routing SIDs), 3fff::/20 (documentation prefix), and 100:0:0:1::/64 (Dummy IPv6 Prefix). This omission could allow an attacker to reach resources hosted on IP addresses within these missing ranges.
Recommendations Upgrade to version 0.2.4. As a temporary workaround, disable IPv6 by setting EnableIPv6(false).
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-918: Server-Side Request Forgery (SSRF)
Related identifiers
CVE-2026-54452
GHSA-XGCH-X3MX-CM3C
GO-2026-5997
OPENSUSE-SU-2026:21483-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com