CVE-2026-73087

Name of the Vulnerable Software and Affected Versions Dozzle versions 10.5.2 through 10.6.14

Description The isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, utilized by safeDialContext for webhook notification URLs, fails to inspect IPv4 addresses embedded within 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses. This allows an authenticated user to bypass the guard and reach loopback or link-local targets. SSRF (Server-Side Request Forgery) is a flaw where an attacker can induce the server to make requests to an unintended location.

Recommendations Update to version 10.6.15.