GitHub Advisoryadvisory · Go

GHSA-xgch-x3mx-cm3c safeurl is Missing IPv6 CIDR Ranges in Blocklist

MEDIUM Published 2026-07-15 Modified 2026-07-15 Official page ↗
Aliases
CVE-2026-54452
Ecosystem
Go
Packages
github.com/doyensec/safeurl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-918
Reviewed
2026-07-15

Affected packages

• Go github.com/doyensec/safeurl: < 0.2.4 → fixed in 0.2.4

Description

The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: • `64:ff9b:1::/48`: NAT64 local-use prefix (RFC 8215) • `5f00::/16`: Segment Routing (SRv6) SIDs (RFC 9602) • `3fff::/20`: documentation prefix (RFC 9637) • `100:0:0:1::/64`: Dummy IPv6 Prefix (RFC 9780) Impact If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges. Workarounds Disable IPv6 by setting `EnableIPv6(false)`. This is the default behavior of the library. Resolution Upgrade to v0.2.4 Credits safeurl thanks @tonghuaroot for reporting.

Related

Alias · CVE (1)

  • CVE-2026-54452 safeurl is a server-side request forgery protection library. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References